CVE-2024-20385: Cisco Nexus Dashboard Orchestrator SSL/TLS Flaw

CVE-2024-20385 Overview

CVE-2024-20385 is a certificate validation vulnerability [CWE-295] in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO). The flaw exists because the Validate Peer Certificate site management feature only validates certificates for Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud Network Controller (CNC), and Cisco Nexus Dashboard when a new site is added or an existing site is reregistered. An unauthenticated, remote attacker positioned on the network path can intercept traffic and impersonate a managed device using a crafted certificate. Successful exploitation exposes sensitive information transmitted between NDO and the managed infrastructure.

Critical Impact
A network-adjacent attacker can perform a machine-in-the-middle attack against NDO management traffic and harvest sensitive data exchanged with APIC, CNC, and Nexus Dashboard devices.

Affected Products

Cisco Nexus Dashboard Orchestrator (NDO)
Deployments managing Cisco Application Policy Infrastructure Controller (APIC)
Deployments managing Cisco Cloud Network Controller (CNC) and Cisco Nexus Dashboard sites

Discovery Timeline

2024-10-02 - CVE-2024-20385 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20385

Vulnerability Analysis

Cisco Nexus Dashboard Orchestrator centrally manages multi-site fabric policies across APIC, CNC, and Nexus Dashboard deployments. Communication between NDO and these controllers relies on SSL/TLS to protect configuration data, credentials, and telemetry.

The Validate Peer Certificate feature is designed to authenticate the remote controller during TLS session establishment. However, the implementation only performs full certificate validation at site onboarding time or when a site is reregistered. Subsequent management sessions do not re-verify peer certificates against the trusted material captured during onboarding.

This gap allows an attacker in a network-adjacent position to present a forged certificate during any post-onboarding session. NDO accepts the session, enabling the attacker to decrypt and read management traffic.

Root Cause

The root cause is improper certificate validation [CWE-295] within the site management workflow. Certificate trust decisions are cached to the onboarding event rather than enforced continuously on every TLS handshake. This design contradicts the expectation that peer certificate validation occurs on each new connection to detect substitution or forgery.

Attack Vector

Exploitation requires the attacker to occupy a machine-in-the-middle position on the network path between NDO and a managed Cisco controller. The attacker intercepts the TCP session, terminates the client TLS handshake, and presents an attacker-controlled certificate that impersonates the managed device. Because NDO does not re-validate the certificate against the onboarding trust anchor, the session proceeds and management data is exposed to the attacker.

The attack complexity is high because it depends on the adversary already having network positioning capable of redirecting traffic between NDO and its managed sites. No authentication or user interaction is required.

No verified public proof-of-concept code is available. See the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20385

Indicators of Compromise

Unexpected TLS certificate changes on sessions between NDO and APIC, CNC, or Nexus Dashboard endpoints outside of documented maintenance windows.
ARP cache anomalies, gratuitous ARP replies, or unusual routing updates on management VLANs carrying NDO traffic.
New or unexpected middleboxes and TLS terminators appearing on the path between NDO and managed controllers.

Detection Strategies

Monitor certificate fingerprints and issuers on NDO-to-controller connections and alert on any deviation from the onboarded certificate.
Inspect network flow records for asymmetric routing or unexpected next-hops on the NDO management network.
Correlate site reregistration events in NDO with change-management tickets to identify unauthorized reregistrations that may reset certificate trust.

Monitoring Recommendations

Enable and forward NDO audit logs and TLS session logs to a centralized SIEM or data lake for baseline comparison.
Deploy network detection tooling capable of identifying TLS anomalies, downgrade attempts, and certificate substitution on management segments.
Continuously monitor Layer 2 and Layer 3 control plane activity on VLANs carrying NDO management traffic for spoofing indicators.

How to Mitigate CVE-2024-20385

Immediate Actions Required

Apply the fixed Cisco Nexus Dashboard Orchestrator release identified in the Cisco Security Advisory as soon as change windows allow.
Restrict NDO management traffic to dedicated, segmented networks with strict access control lists between NDO and managed controllers.
Audit site registration history in NDO and validate that current peer certificates match expected trust anchors for APIC, CNC, and Nexus Dashboard sites.

Patch Information

Cisco has released fixed software for Nexus Dashboard Orchestrator. Refer to the Cisco Security Advisory cisco-sa-ndo-tlsvld-FdUF3cpw for the specific fixed release trains and upgrade guidance for your deployment.

Workarounds

Cisco has not published a workaround for this vulnerability; upgrading to a fixed release is required.
Where patching is delayed, enforce out-of-band management, cryptographic network isolation such as MACsec or IPsec, and strong Layer 2 protections including DHCP snooping and Dynamic ARP Inspection to reduce the feasibility of machine-in-the-middle positioning.
Reregister managed sites only through controlled change windows and verify controller certificate fingerprints out-of-band before completing reregistration.

bash

# Example: verify the current TLS certificate presented by a managed controller
# and compare its fingerprint to the trusted value captured at onboarding.
openssl s_client -connect <controller-host>:443 -servername <controller-host> </dev/null \
  | openssl x509 -noout -fingerprint -sha256