PT-2023-2208 · Cisco · Cisco Secure Network Analytics

Publicado 2023-04-05 · Atualizado 2023-04-12 · CVE-2023-20103

Positive Technologies (AI Summary)

CVSS v2.0

8.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Cisco Secure Network Analytics (affected versions not specified)

Description A vulnerability in the web interface of Cisco Secure Network Analytics is due to insufficient validation of user input. This could allow an authenticated, remote attacker to execute arbitrary code as a root user on an affected device by uploading a crafted file. A successful exploit could allow the attacker to execute code on the affected device. The attacker would need to have valid Administrator credentials on the affected device to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Enumeração de Fraquezas

CWE-20

CWE-94

Identificadores relacionados

BDU:2023-01955

CVE-2023-20103

Produtos afetados

Cisco Secure Network Analytics

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-20103 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01955 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-stealth-rce-BDwXFK9C · Aviso do Fabricante
• https://t.me/cvenotify/47632 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20103 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023040632 · Nota