CVE-2024-20489

CWE-256CWE-522 — Insufficiently Protected CredentialsCWE-78 — OS Command Injection4 documents4 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 77.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco IOS XR SoftwareCisco IOS XR
Timeline
PublishedSep 11

Description

A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running Cisco IOS XR Software. An attacker could exploit this vulnerability by accessing the configuration files on an affected system. A successful exploit could allow the attacker to view MongoDB credentials.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NExploitability: 2.0 | Impact: 5.8

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xr_software5 versions+4
▶NVDcisco/ios_xr5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-3wfw-cf7h-38c7: A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obt↗2024-09-11
▶
CVEList
Cisco Routed Passive Optical Network Cleartext Password Vulnerability↗2024-09-11
▶

📋Vendor Advisories

1
Cisco
Cisco Routed Passive Optical Network Controller Vulnerabilities↗2024-09-11
▶
CVE-2024-20489 (MEDIUM CVSS 5.5) | A vulnerability in the storage meth | cvebase.io