PT-2023-2512 · Cisco · Cisco Industrial Network Director

Published 2023-04-19 · Updated 2025-08-11 · CVE-2023-20039

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director (affected versions not specified)

Description A vulnerability in the Cisco Industrial Network Director could allow an authenticated, local attacker to read application data due to insufficient default file permissions applied to the application data directory. An attacker could exploit this vulnerability by accessing files in the application data directory, potentially allowing them to view sensitive information.

Recommendations For all affected versions, update to the latest software version released by Cisco that addresses this vulnerability. As a temporary workaround, consider restricting access to the application data directory to minimize the risk of exploitation. Avoid using the default file permissions in the application data directory until the issue is resolved. At the moment, there is no information about additional mitigation measures or workarounds that address this vulnerability.

Fix

Incorrect Default Permissions

Files Accessible to External Parties

Weakness Enumeration

CWE-276

CWE-552

Related Identifiers

BDU:2023-02309

CVE-2023-20039

Affected Products

Cisco Industrial Network Director

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20039 · Security Note
• https://bdu.fstec.ru/vul/2023-02309 · Security Note
• https://t.me/true_secator/4310 · Telegram Post
• https://t.me/cveNotify/131702 · Telegram Post
• https://twitter.com/CVEnew/status/1857448665293504734 · Twitter Post