This vulnerability, tracked as CVE-2024-20399, is a command injection case (CVSS score: 6.0) that allows executing arbitrary commands as root. According to Sygnia, Velvet Ant can use this vulnerability to connect to Cisco Nexus devices, upload files and run code.

Cisco stated that the vulnerability was caused by insufficient validation of arguments passed to certain CLI commands and that attackers could abuse these commands. Because this vulnerability requires administrative privileges, it is rated as low severity. Affected devices include MDS 9000, Nexus 3000, 5500, 5600, 6000, 7000 and 9000 series switches.

Velvet Ant used F5 BIG-IP devices to steal customer and financial information in a three-year cyberattack against an organization in East Asia. Sygnia emphasized that there are difficulties in detecting such malicious activities due to the lack of monitoring of network devices.

During the same period, GreyNoise reported on another critical vulnerability (CVE-2024-0769, CVSS score: 9.8) affecting D-Link DIR-859 routers. This vulnerability is used to collect account information and will not be patched as the product is end-of-life.