CVE-2024-20429
published 2024-07-17CVE-2024-20429: A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute…
PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.62%
45.5th percentile
A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device.
This vulnerability is due to insufficient input validation in certain portions of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To successfully exploit this vulnerability, an attacker would need at least valid Operator credentials.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | asyncos | — | — |
| cisco | cisco_secure_email | — | — |
| cisco | cisco_secure_email | — | — |
| cisco | cisco_secure_email | — | — |
| cisco | cisco_secure_email | — | — |
| cisco | cisco_secure_email | — | — |
| cisco | cisco_secure_email | — | — |
| cisco | cisco_secure_email | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
vendor_cisco·2024-07-17·CVSS 6.5
CVE-2024-20429 [MEDIUM] CWE-74 Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device.
This vulnerability is due to insufficient input validation in certain portions of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To successfully exploit this vulnerability, an attacker would need at least valid Operator credentials.
Cisco has released software updates that address this vulnerabilit
Cisco
Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2024-20429 Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
CVE-2024-20429: Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device. This vulnerability is due to insufficient input validation in certain portions of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To successfully exploit this vulnerability, an attacker would need at least valid Operator credentials. Cisco has released software updates that address thi
GHSA
GHSA-9h6c-2f95-gmf7: A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execu
ghsa_unreviewed·2024-07-17
CVE-2024-20429 [MEDIUM] CWE-74 GHSA-9h6c-2f95-gmf7: A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execu
A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device.
This vulnerability is due to insufficient input validation in certain portions of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To successfully exploit this vulnerability, an attacker would need at least valid Operator credentials.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-17
Published