CVE-2024-20435 Command injection in Cisco Secure Web Appliance

High 8.8 Published 17 Jul 2024 Updated 1 Aug 2024

Authenticated local attackers can execute arbitrary commands and gain root privileges on Cisco Secure Web Appliance via CLI input validation flaws.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-20435?

CVE-2024-20435 is a high-severity command injection vulnerability in Cisco Asyncos, published on 17 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this vulnerability by authenticating to the system and executing a crafted command on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least guest credentials.

Weakness: CWE-250

Which versions are affected by CVE-2024-20435?

It affects 1 product.

Products include Cisco Asyncos.

How do I fix CVE-2024-20435?

No fix has been published for CVE-2024-20435 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-20435 being exploited?

There is no known exploitation of CVE-2024-20435 in the wild and no public exploit code.

All Cisco Asyncos vulnerabilities

Sources

Also known as GHSA-p6xf-x5px-f2vq.