CVE-2023-20076
published 2023-02-12CVE-2023-20076: A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.51%
71.5th percentile
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | 807_industrial_integrated_services_router_firmware | < 15.9\(3\) | 15.9\(3\) |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 807_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | < 15.9\(3\) | 15.9\(3\) |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 809_industrial_integrated_services_router_firmware | — | — |
| cisco | 829_industrial_integrated_services_router_firmware | < 15.9\(3\) | 15.9\(3\) |
| cisco | 829_industrial_integrated_services_router_firmware | — | — |
| cisco | 829_industrial_integrated_services_router_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit requires deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file containing unsanitized parameters ↗
- →Monitor Cisco IOx application activation events for anomalous or malformed parameters in activation payload files, particularly those that may contain command injection sequences ↗
- →Successful exploitation results in arbitrary command execution as root on the underlying host OS — monitor for unexpected root-level process spawning from IOx hosting processes ↗
- ·Attacker must be authenticated to exploit this vulnerability; prioritize monitoring for authenticated IOx users deploying or activating applications ↗
- ·Cisco Bug IDs CSCwc66882 and CSCwc67015 are associated with this vulnerability and can be used to track affected software versions in Cisco's bug search tool ↗
- ·No workarounds are available; detection must rely on behavioral monitoring and patching ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_cisco7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco IOx Application Hosting Environment Command Injection Vulnerability
vendor_cisco·2023-02-01·CVSS 7.2
CVE-2023-20076 [HIGH] CWE-233 Cisco IOx Application Hosting Environment Command Injection Vulnerability
Cisco IOx Application Hosting Environment Command Injection Vulnerability
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system.
This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this
Cisco
Cisco IOx Application Hosting Environment Command Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2023-20076 Cisco IOx Application Hosting Environment Command Injection Vulnerability
CVE-2023-20076: Cisco IOx Application Hosting Environment Command Injection Vulnerability
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: C
GHSA
GHSA-q7pv-4cxx-gq42: A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root o
ghsa_unreviewed·2023-02-12
CVE-2023-20076 [HIGH] CWE-78 GHSA-q7pv-4cxx-gq42: A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root o
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-02-12
Published