PT-2024-3855 · Cisco · Cisco Crosswork Network Services Orchestrator

Elias Ikkelä-Koski

·

Published

2024-05-15

·

Updated

2024-07-03

·

CVE-2024-20326

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ConfD versions (affected versions not specified) Cisco Crosswork Network Services Orchestrator versions (affected versions not specified)
Description A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command with crafted arguments. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system with the privileges of the root user.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2024-04251
CVE-2024-20326

Affected Products

Cisco Crosswork Network Services Orchestrator