CVE-2023-20097

CWE-77 — Command Injection4 documents4 sources
Severity
6.7MEDIUM
EPSS
0.4%
top 42.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cisco Aironet Access Point SoftwareCisco IOS XECisco Wireless LAN Controller Software+1 more
Timeline
PublishedMar 23

Description

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root acces…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:NExploitability: 1.5 | Impact: 2.7

Affected Packages4 packages

▶NVDcisco/ios_xe17.1 — 17.3.6+3

🔴Vulnerability Details

2
GHSA
GHSA-59p2-366r-gx84: A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with r↗2023-03-23
▶
CVEList
Cisco Access Point Software Command Injection Vulnerability↗2023-03-23
▶

📋Vendor Advisories

1
Cisco
Cisco Access Point Software Command Injection Vulnerability↗2023-03-22
▶
CVE-2023-20097 (MEDIUM CVSS 6.7) | A vulnerability in Cisco access poi | cvebase.io