7.8

CVE-2024-20435

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root.

 This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this vulnerability by authenticating to the system and executing a crafted command on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least guest credentials.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Asyncos Version 11.7.0-406
Cisco ≫ Asyncos Version 11.7.0-418
Cisco ≫ Asyncos Version 11.7.1-006
Cisco ≫ Asyncos Version 11.7.1-020
Cisco ≫ Asyncos Version 11.7.1-049
Cisco ≫ Asyncos Version 11.7.2-011
Cisco ≫ Asyncos Version 11.8.0-414
Cisco ≫ Asyncos Version 11.8.1-023
Cisco ≫ Asyncos Version 11.8.3-018
Cisco ≫ Asyncos Version 11.8.3-021
Cisco ≫ Asyncos Version 12.0.1-268
Cisco ≫ Asyncos Version 12.0.3-007
Cisco ≫ Asyncos Version 12.5.1-011
Cisco ≫ Asyncos Version 12.5.2-007
Cisco ≫ Asyncos Version 12.5.4-005
Cisco ≫ Asyncos Version 12.5.5-004
Cisco ≫ Asyncos Version 12.5.6-008
Cisco ≫ Asyncos Version 14.0.2-012
Cisco ≫ Asyncos Version 14.0.3-014
Cisco ≫ Asyncos Version 14.0.4-005
Cisco ≫ Asyncos Version 14.0.5-007
Cisco ≫ Asyncos Version 14.5.0-498
Cisco ≫ Asyncos Version 14.5.1-016
Cisco ≫ Asyncos Version 14.5.2-011
Cisco ≫ Asyncos Version 15.0.0-322
Cisco ≫ Asyncos Version 15.0.0-355
Cisco ≫ Asyncos Version 15.1.0-287
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.059
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Cisco PSIRT 8.8 2 6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swa-priv-esc-7uHpZsCC
Vendor Advisory