PT-2023-4432 · Cisco · Cisco Duo Device Health Application

Published 2023-08-16 · Updated 2024-03-21 · CVE-2023-20229

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Duo Device Health Application for Windows (affected versions not specified)

Description A vulnerability in the CryptoService function could allow an authenticated, local attacker with low privileges to conduct directory traversal attacks and overwrite arbitrary files on an affected system. This issue is due to insufficient input validation, allowing an attacker to exploit the vulnerability by executing a directory traversal attack. A successful exploit could result in a denial of service (DoS) condition or data loss on the affected system, as an attacker could use a cryptographic key to overwrite arbitrary files with SYSTEM-level privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-04777

CVE-2023-20229

Affected Products

Cisco Duo Device Health Application

References · 10

• https://osv.dev/vulnerability/CVE-2023-20229 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04777 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20229 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-dha-filewrite-xPMBMZAK · Vendor Advisory
• https://twitter.com/CVEnew/status/1691931060102218044 · Twitter Post
• https://t.me/cibsecurity/68720 · Telegram Post
• https://twitter.com/SecurityAid/status/1770799202727051381 · Twitter Post
• https://twitter.com/fletch_ai/status/1692387783157989824 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691872086422139126 · Twitter Post
• https://t.me/cvenotify/56683 · Telegram Post