CVE-2024-20326

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command with crafted arguments. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system with the privileges of the root user.

• CWE-78
• CWE-77

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnfd-rwpesc-ZAOufyx8Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-rwpesc-qrQGnh3fVendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnfd-rwpesc-ZAOufyx8Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-rwpesc-qrQGnh3fVendor Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-20320A vulnerability in the SSH client feature of Cisco IOS XR So…7.8
• CVE-2024-20321A vulnerability in the External Border Gateway Protocol (eBG…8.6
• CVE-2024-20322A vulnerability in the access control list (ACL) processing …5.8
• CVE-2024-20323A vulnerability in Cisco Intelligent Node (iNode) Software c…7.5
• CVE-2024-20324A vulnerability in the CLI of Cisco IOS XE Software could al…5.5
• CVE-2024-20325A vulnerability in the Live Data server of Cisco Unified Int…7.1
• CVE-2024-20327A vulnerability in the PPP over Ethernet (PPPoE) termination…7.4
• CVE-2024-20328A vulnerability in the VirusEvent feature of ClamAV could al…5.3
• CVE-2024-20329A vulnerability in the SSH subsystem of Cisco Adaptive Secur…9.9
• CVE-2024-2033The Video Conferencing with Zoom plugin for WordPress is vul…4.3
• CVE-2024-20330A vulnerability in the Snort 2 and Snort 3 TCP and UDP detec…7.5
• CVE-2024-20331A vulnerability in the session authentication functionality …5.9