PT-2024-1484 · Cisco · Cisco Prime Infrastructure+1

Jérôme Nokin · Published 2024-01-10 · Updated 2024-02-02 · CVE-2023-20260

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (affected versions not specified) Cisco Evolved Programmable Network (EPN) Manager (affected versions not specified)

Description The issue is related to the improper processing of command line arguments to application scripts in the application CLI of the affected systems. This could allow an authenticated, local attacker to gain escalated privileges by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.

Recommendations For Cisco Prime Infrastructure, consider restricting access to the application CLI until a patch is available. For Cisco Evolved Programmable Network (EPN) Manager, avoid using malicious options in the CLI commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Argument Injection

Weakness Enumeration

CWE-284

CWE-88

Related Identifiers

BDU:2024-00991

CVE-2023-20260

Affected Products

Cisco Evolved Programmable Network (Epn) Manager

Cisco Prime Infrastructure

References · 5

• https://osv.dev/vulnerability/CVE-2023-20260 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20260 · Security Note
• https://bdu.fstec.ru/vul/2024-00991 · Security Note
• https://twitter.com/CVEnew/status/1747669020755783878 · Twitter Post