PT-2023-2217 · Cisco · Cisco Ios Xe Sd-Wan+1

Published 2023-03-22 · Updated 2023-05-22 · CVE-2023-20035

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified)

Description The issue is due to insufficient input validation by the system CLI, allowing an authenticated, local attacker to execute arbitrary commands with elevated privileges. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges, potentially gaining complete control over the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-146

Related Identifiers

BDU:2023-01965

CVE-2023-20035

Affected Products

Cisco Ios Xe Sd-Wan

Cisco Ios Xe

References · 8

• https://bdu.fstec.ru/vul/2023-01965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20035 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw · Vendor Advisory
• https://t.me/true_secator/4210 · Telegram Post
• https://t.me/cvenotify/46720 · Telegram Post
• https://t.me/cvenotify/47183 · Telegram Post
• https://t.me/cibsecurity/60600 · Telegram Post
• https://t.me/cvenotify/50925 · Telegram Post