PT-2023-2217 · Cisco · Cisco Ios Xe Sd-Wan+1

CVE-2023-20035 · Publicado 2023-03-22 · Atualizado 2023-05-22

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified)

Description The issue is due to insufficient input validation by the system CLI, allowing an authenticated, local attacker to execute arbitrary commands with elevated privileges. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges, potentially gaining complete control over the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-146

Identificadores relacionados

BDU:2023-01965

CVE-2023-20035

Produtos afetados

Cisco Ios Xe Sd-Wan

Cisco Ios Xe

Referências · 8

• https://bdu.fstec.ru/vul/2023-01965 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-20035 · Nota de Segurança
• https://t.me/true_secator/4210 · Publicação no Telegram
• https://t.me/cvenotify/46720 · Publicação no Telegram
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw · Aviso do Fabricante
• https://t.me/cvenotify/47183 · Publicação no Telegram
• https://t.me/cibsecurity/60600 · Publicação no Telegram
• https://t.me/cvenotify/50925 · Publicação no Telegram