CVE-2023-20035 - Vulnerability Details

Vendors	Products
Cisco	1100-4g\/6g Integrated Services Router 1100-4p Integrated Services Router 1100-8p Integrated Services Router 1100 Integrated Services Router 1101-4p Integrated Services Router 1101 Integrated Services Router 1109-2p Integrated Services Router 1109-4p Integrated Services Router 1109 Integrated Services Router 1120 Integrated Services Router 1131 Integrated Services Router 1160 Integrated Services Router 4221 Integrated Services Router 4321 Integrated Services Router 4331 Integrated Services Router 4351 Integrated Services Router 4431 Integrated Services Router 4451-x Integrated Services Router 4451 Integrated Services Router 4461 Integrated Services Router Asr 1001-x Asr 1002-hx Asr 1006-x Asr 1009-x Catalyst 8000v Edge Catalyst 8200 Catalyst 8300 Catalyst 8300-1n1s-4t2x Catalyst 8300-1n1s-6t Catalyst 8300-2n2s-4t2x Catalyst 8300-2n2s-6t Catalyst 8500 Catalyst 8500-4qc Catalyst 8500l Catalyst 8510csr Catalyst 8510msr Catalyst 8540csr Catalyst 8540msr Csr 1000v Ios Xe Sd-wan

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-20035", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "dateUpdated": "2024-10-28T16:32:57.941Z", "dateReserved": "2022-10-27T00:00:00", "datePublished": "2023-03-23T00:00:00"}, "containers": {"cna": {"title": "Cisco IOS XE SD-WAN Software Command Injection Vulnerability", "datePublic": "2023-03-22T00:00:00", "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2023-03-23T00:00:00"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software ", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"name": "20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability", "tags": ["vendor-advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-146", "cweId": "CWE-146"}]}], "source": {"advisory": "cisco-sa-ios-xe-sdwan-VQAhEjYw", "defect": [["CSCvx72976", "CSCwc41942"]], "discovery": "INTERNAL"}, "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:57:35.562Z"}, "title": "CVE Program Container", "references": [{"name": "20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-28T16:19:23.522101Z", "id": "CVE-2023-20035", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T16:32:57.941Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2023-20035 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

assignerShortName : cisco (string)

dateUpdated : 2024-10-28T16:32:57.941Z (string)

dateReserved : 2022-10-27T00:00:00 (string)

datePublished : 2023-03-23T00:00:00 (string)

}

containers : { »

cna : { »

title : Cisco IOS XE SD-WAN Software Command Injection Vulnerability (string)

datePublic : 2023-03-22T00:00:00 (string)

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2023-03-23T00:00:00 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory. (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco IOS XE Software (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

name : 20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

version : 3.1 (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

attackVector : LOCAL (string)

attackComplexity : LOW (string)

privilegesRequired : LOW (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : CWE-146 (string)

cweId : CWE-146 (string)

}

]

}

]

source : { »

advisory : cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

defect : [ »

0 : [ »

0 : CSCvx72976 (string)

1 : CSCwc41942 (string)

]

discovery : INTERNAL (string)

}

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T08:57:35.562Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-28T16:19:23.522101Z (string)

id : CVE-2023-20035 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-28T16:32:57.941Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw", "name": "20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:57:35.562Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-20035", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-28T16:19:23.522101Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T16:23:27.515Z"}}], "cna": {"title": "Cisco IOS XE SD-WAN Software Command Injection Vulnerability", "source": {"defect": [["CSCvx72976", "CSCwc41942"]], "advisory": "cisco-sa-ios-xe-sdwan-VQAhEjYw", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software ", "versions": [{"status": "affected", "version": "n/a"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}], "datePublic": "2023-03-22T00:00:00", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw", "name": "20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-146", "description": "CWE-146"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2023-03-23T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2023-20035", "state": "PUBLISHED", "dateUpdated": "2024-10-28T16:32:57.941Z", "dateReserved": "2022-10-27T00:00:00", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2023-03-23T00:00:00", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

name : 20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T08:57:35.562Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-20035 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-28T16:19:23.522101Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-28T16:23:27.515Z (string)

}

]

cna : { »

title : Cisco IOS XE SD-WAN Software Command Injection Vulnerability (string)

source : { »

defect : [ »

0 : [ »

0 : CSCvx72976 (string)

1 : CSCwc41942 (string)

]

advisory : cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.8 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco IOS XE Software (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

datePublic : 2023-03-22T00:00:00 (string)

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

name : 20230322 Cisco IOS XE SD-WAN Software Command Injection Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-146 (string)

description : CWE-146 (string)

}

]

}

]

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2023-03-23T00:00:00 (string)

}

cveMetadata : { »

cveId : CVE-2023-20035 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-28T16:32:57.941Z (string)

dateReserved : 2022-10-27T00:00:00 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

datePublished : 2023-03-23T00:00:00 (string)

assignerShortName : cisco (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*", "matchCriteriaId": "16266B9E-E613-45FA-A02B-51EED8BEFCC9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:catalyst_8000v_edge:-:*:*:*:*:*:*:*", "matchCriteriaId": "CF365FC4-46E3-4564-9F25-1C2FBE70057B", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1100-4g\\/6g_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6F668B9-2C1D-4306-8286-35E67D0F67C7", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2D2305B-B69E-4F74-A44E-07B3205CE9F7", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "26DD41B3-1D1D-44D3-BA8E-5A66AFEE77E6", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "1952B64C-4AE0-4CCB-86C5-8D1FF6A12822", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "5AAD4397-6DCF-493A-BD61-3A890F6F3AB2", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "5EB8A757-7888-4AC2-BE44-B89DB83C6C77", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "3F2F0A8E-97F6-41AC-BE67-4B2D60F9D36B", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "BB9229F3-7BCE-46C4-9879-D57B5BAAE44E", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "B80890A8-E3D3-462C-B125-9E9BC6525B02", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "7AFE0FC1-EEBC-42F0-88B0-4AF5B76DDD97", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "F3F374DC-B9F7-4515-A064-01BB436CA984", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "D916389F-54DB-44CB-91DD-7CE3C7059350", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C8AED7C-DDA3-4C29-BB95-6518C02C551A", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "9421DBEF-AE42-4234-B49F-FCC34B804D7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "5419CB9F-241F-4431-914F-2659BE27BEA5", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "7DE02DBE-EAD5-4F37-8AB7-DF46A605A0E2", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "5720462A-BE6B-4E84-A1A1-01E80BBA86AD", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "818CEFA6-208C-43C3-8E43-474A93ADCF21", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "82225D40-537F-41D2-B1C4-1B7D06466B06", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8B60888-6E2B-494E-AC65-83337661EE7D", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*", "matchCriteriaId": "09C913FF-63D5-43FB-8B39-598EF436BA5A", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD2794BD-C8CE-46EF-9857-1723FCF04E46", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE7401B7-094C-46EB-9869-2F0372E8B26B", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*", "matchCriteriaId": "8D8A72FD-D8B0-45B5-8FAD-6D8395BB218A", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*", "matchCriteriaId": "EE9EABE0-5FB0-4277-A389-87732E750B7C", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*", "matchCriteriaId": "72BBF8E8-7AD9-46B8-8B02-F0DB1F95E1CD", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E7E8914-7B25-4097-8B22-6928C1F03D5A", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*", "matchCriteriaId": "B207857B-C483-47DF-9FC7-6A05B866BF60", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD26746A-80D1-4C48-BF77-E9F7EEEF7EA7", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDB16CCE-1E89-4707-86C1-97F2FB5B62B9", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*", "matchCriteriaId": "7A82CE19-C3C4-4FAD-A1B3-AB91EDB61591", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*", "matchCriteriaId": "A1DBA393-232D-40E6-9CDB-DF82D2E7A5B6", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*", "matchCriteriaId": "04AB61E9-0148-495E-BD21-64D52DE60A6C", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*", "matchCriteriaId": "85D2C587-E95B-4E74-88CF-5930072258D3", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*", "matchCriteriaId": "D3D1BB0B-0EFE-4C6D-A18E-3E48ABA01F00", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*", "matchCriteriaId": "74270062-2030-45A0-9C93-C1F3B7C88E8B", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*", "matchCriteriaId": "0F403859-F034-4DD9-9CA5-708EADECB380", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:csr_1000v:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF8B0B49-2C99-410B-B011-5B821C5992FB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory."}], "id": "CVE-2023-20035", "lastModified": "2024-11-21T07:40:24.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ykramarz@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-23T17:15:14.030", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-146"}], "source": "ykramarz@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 16266B9E-E613-45FA-A02B-51EED8BEFCC9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:cisco:catalyst_8000v_edge:-:*:*:*:*:*:*:* (string)

matchCriteriaId : CF365FC4-46E3-4564-9F25-1C2FBE70057B (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A6F668B9-2C1D-4306-8286-35E67D0F67C7 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2D2305B-B69E-4F74-A44E-07B3205CE9F7 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 26DD41B3-1D1D-44D3-BA8E-5A66AFEE77E6 (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 1952B64C-4AE0-4CCB-86C5-8D1FF6A12822 (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5AAD4397-6DCF-493A-BD61-3A890F6F3AB2 (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5EB8A757-7888-4AC2-BE44-B89DB83C6C77 (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3F2F0A8E-97F6-41AC-BE67-4B2D60F9D36B (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BB9229F3-7BCE-46C4-9879-D57B5BAAE44E (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B80890A8-E3D3-462C-B125-9E9BC6525B02 (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7AFE0FC1-EEBC-42F0-88B0-4AF5B76DDD97 (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F3F374DC-B9F7-4515-A064-01BB436CA984 (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D916389F-54DB-44CB-91DD-7CE3C7059350 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6C8AED7C-DDA3-4C29-BB95-6518C02C551A (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 9421DBEF-AE42-4234-B49F-FCC34B804D7F (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5419CB9F-241F-4431-914F-2659BE27BEA5 (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7DE02DBE-EAD5-4F37-8AB7-DF46A605A0E2 (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5720462A-BE6B-4E84-A1A1-01E80BBA86AD (string)

vulnerable : false (boolean)

}

18 : { »

criteria : cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 818CEFA6-208C-43C3-8E43-474A93ADCF21 (string)

vulnerable : false (boolean)

}

19 : { »

criteria : cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 82225D40-537F-41D2-B1C4-1B7D06466B06 (string)

vulnerable : false (boolean)

}

20 : { »

criteria : cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E8B60888-6E2B-494E-AC65-83337661EE7D (string)

vulnerable : false (boolean)

}

21 : { »

criteria : cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 09C913FF-63D5-43FB-8B39-598EF436BA5A (string)

vulnerable : false (boolean)

}

22 : { »

criteria : cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:* (string)

matchCriteriaId : CD2794BD-C8CE-46EF-9857-1723FCF04E46 (string)

vulnerable : false (boolean)

}

23 : { »

criteria : cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DE7401B7-094C-46EB-9869-2F0372E8B26B (string)

vulnerable : false (boolean)

}

24 : { »

criteria : cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8D8A72FD-D8B0-45B5-8FAD-6D8395BB218A (string)

vulnerable : false (boolean)

}

25 : { »

criteria : cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:* (string)

matchCriteriaId : EE9EABE0-5FB0-4277-A389-87732E750B7C (string)

vulnerable : false (boolean)

}

26 : { »

criteria : cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 72BBF8E8-7AD9-46B8-8B02-F0DB1F95E1CD (string)

vulnerable : false (boolean)

}

27 : { »

criteria : cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5E7E8914-7B25-4097-8B22-6928C1F03D5A (string)

vulnerable : false (boolean)

}

28 : { »

criteria : cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B207857B-C483-47DF-9FC7-6A05B866BF60 (string)

vulnerable : false (boolean)

}

29 : { »

criteria : cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:* (string)

matchCriteriaId : CD26746A-80D1-4C48-BF77-E9F7EEEF7EA7 (string)

vulnerable : false (boolean)

}

30 : { »

criteria : cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BDB16CCE-1E89-4707-86C1-97F2FB5B62B9 (string)

vulnerable : false (boolean)

}

31 : { »

criteria : cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7A82CE19-C3C4-4FAD-A1B3-AB91EDB61591 (string)

vulnerable : false (boolean)

}

32 : { »

criteria : cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A1DBA393-232D-40E6-9CDB-DF82D2E7A5B6 (string)

vulnerable : false (boolean)

}

33 : { »

criteria : cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 04AB61E9-0148-495E-BD21-64D52DE60A6C (string)

vulnerable : false (boolean)

}

34 : { »

criteria : cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 85D2C587-E95B-4E74-88CF-5930072258D3 (string)

vulnerable : false (boolean)

}

35 : { »

criteria : cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D3D1BB0B-0EFE-4C6D-A18E-3E48ABA01F00 (string)

vulnerable : false (boolean)

}

36 : { »

criteria : cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 74270062-2030-45A0-9C93-C1F3B7C88E8B (string)

vulnerable : false (boolean)

}

37 : { »

criteria : cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0F403859-F034-4DD9-9CA5-708EADECB380 (string)

vulnerable : false (boolean)

}

38 : { »

criteria : cpe:2.3:h:cisco:csr_1000v:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BF8B0B49-2C99-410B-B011-5B821C5992FB (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory. (string)

}

]

id : CVE-2023-20035 (string)

lastModified : 2024-11-21T07:40:24.403 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : ykramarz@cisco.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-03-23T17:15:14.030 (string)

references : [ »

0 : { »

source : ykramarz@cisco.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw (string)

}

]

sourceIdentifier : ykramarz@cisco.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-146 (string)

}

]

source : ykramarz@cisco.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object