CVE-2024-20358 — OS Command Injection in Cisco Secure Firewall Adaptive Security Appliance Software

CWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUMNVD
CNA6.0
EPSS
0.0%
top 93.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cisco Secure Firewall Adaptive Security Appliance SoftwareCisco Secure Firewall Threat Defense SoftwareCisco Adaptive Security Appliance Software+1 more
Timeline
PublishedApr 24

Description

A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability exists because the contents of a backup file are improperly sanitized at restore time. An att…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages4 packages

🔴Vulnerability Details

2
GHSA
GHSA-x299-q796-x4w4: A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threa↗2024-04-24
▶
CVEList
CVE-2024-20358: A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threa↗2024-04-24
▶

📋Vendor Advisories

1
Cisco
Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability↗2024-04-24
▶
CVE-2024-20358 — OS Command Injection in Cisco | cvebase