6.7

CVE-2023-20097

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Wireless Lan Controller Software Version < 8.10.183.0
   Cisco ≫ Esw6300 Version-
Cisco ≫ Aironet Access Point Software Version < 17.9.0.135
   Cisco ≫ Aironet 1540 Version-
   Cisco ≫ Aironet 1542d Version-
   Cisco ≫ Aironet 1542i Version-
   Cisco ≫ Aironet 1560 Version-
   Cisco ≫ Aironet 1562d Version-
   Cisco ≫ Aironet 1562e Version-
   Cisco ≫ Aironet 1562i Version-
   Cisco ≫ Aironet 1800 Version-
   Cisco ≫ Aironet 1800i Version-
   Cisco ≫ Aironet 1810 Version-
   Cisco ≫ Aironet 1810w Version-
   Cisco ≫ Aironet 1815 Version-
   Cisco ≫ Aironet 1815i Version-
   Cisco ≫ Aironet 1815m Version-
   Cisco ≫ Aironet 1815t Version-
   Cisco ≫ Aironet 1815w Version-
   Cisco ≫ Aironet 2800 Version-
   Cisco ≫ Aironet 2800e Version-
   Cisco ≫ Aironet 2800i Version-
   Cisco ≫ Aironet 3800 Version-
   Cisco ≫ Aironet 3800e Version-
   Cisco ≫ Aironet 3800i Version-
   Cisco ≫ Aironet 3800p Version-
   Cisco ≫ Aironet 4800 Version-
   Cisco ≫ Catalyst 9100 Version-
   Cisco ≫ Catalyst 9105 Version-
   Cisco ≫ Catalyst 9105ax Version-
   Cisco ≫ Catalyst 9105axi Version-
   Cisco ≫ Catalyst 9105axw Version-
   Cisco ≫ Catalyst 9115 Version-
   Cisco ≫ Catalyst 9115 Ap Version-
   Cisco ≫ Catalyst 9115ax Version-
   Cisco ≫ Catalyst 9115axe Version-
   Cisco ≫ Catalyst 9115axi Version-
   Cisco ≫ Catalyst 9117 Version-
   Cisco ≫ Catalyst 9117 Ap Version-
   Cisco ≫ Catalyst 9117ax Version-
   Cisco ≫ Catalyst 9117axi Version-
   Cisco ≫ Catalyst 9120 Version-
   Cisco ≫ Catalyst 9120 Ap Version-
   Cisco ≫ Catalyst 9120ax Version-
   Cisco ≫ Catalyst 9120axe Version-
   Cisco ≫ Catalyst 9120axi Version-
   Cisco ≫ Catalyst 9120axp Version-
   Cisco ≫ Catalyst 9124 Version-
   Cisco ≫ Catalyst 9124ax Version-
   Cisco ≫ Catalyst 9124axd Version-
   Cisco ≫ Catalyst 9124axi Version-
   Cisco ≫ Catalyst 9130 Version-
   Cisco ≫ Catalyst 9130 Ap Version-
   Cisco ≫ Catalyst 9130ax Version-
   Cisco ≫ Catalyst 9130axe Version-
   Cisco ≫ Catalyst 9130axi Version-
   Cisco ≫ Catalyst Iw6300 Version-
   Cisco ≫ Catalyst Iw6300 Ac Version-
   Cisco ≫ Catalyst Iw6300 Dc Version-
   Cisco ≫ Catalyst Iw6300 Dcw Version-
Cisco ≫ Ios Xe Version < 16.12.8
Cisco ≫ Ios Xe Version >= 17.1 < 17.3.6
Cisco ≫ Ios Xe Version >= 17.4 < 17.6.5
Cisco ≫ Ios Xe Version >= 17.7 < 17.9.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.06% 0.191
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
psirt@cisco.com 4.6 1.5 2.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.