Cisco NX-OS Incorrect Authorization(CVE-2024-20291)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503222);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/16");

  script_cve_id("CVE-2024-20291");

  script_name(english:"Cisco NX-OS Incorrect Authorization(CVE-2024-20291)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the access control list (ACL) programming for port
channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in
standalone NX-OS mode could allow an unauthenticated, remote attacker
to send traffic that should be blocked through an affected device.
This vulnerability is due to incorrect hardware programming that
occurs when configuration changes are made to port channel member
ports. An attacker could exploit this vulnerability by attempting to
send traffic through an affected device. A successful exploit could
allow the attacker to access network resources that should be
protected by an ACL that was applied on port channel subinterfaces.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-po-acl-TkyePgvL
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f87df2e3");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20291");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(284, 863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/02/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/02/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_3000_series_switches");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_9000_series_switches");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nexus_3000_series_switches:9.3%2810%29" :
        {"versionEndIncluding" : "9.3%2810%29", "versionStartIncluding" : "9.3%2810%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%2810%29" :
        {"versionEndIncluding" : "9.3%2810%29", "versionStartIncluding" : "9.3%2810%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.3%2811%29" :
        {"versionEndIncluding" : "9.3%2811%29", "versionStartIncluding" : "9.3%2811%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%2811%29" :
        {"versionEndIncluding" : "9.3%2811%29", "versionStartIncluding" : "9.3%2811%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_3000_series_switches:9.3%2812%29" :
        {"versionEndIncluding" : "9.3%2812%29", "versionStartIncluding" : "9.3%2812%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_9000_series_switches:9.3%2812%29" :
        {"versionEndIncluding" : "9.3%2812%29", "versionStartIncluding" : "9.3%2812%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);