CVE-2024-20306 - OpenCVE

A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2024-03-27T16:58:22.583Z

Updated: 2024-08-16T18:48:47.441Z

Reserved: 2023-11-08T15:08:07.631Z

Link: CVE-2024-20306

Vulnrichment

Updated: 2024-08-01T21:59:41.650Z

NVD

Status : Awaiting Analysis

Published: 2024-03-27T17:15:52.067

Modified: 2024-03-27T17:48:21.140

Link: CVE-2024-20306

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20306", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.631Z", "datePublished": "2024-03-27T16:58:22.583Z", "dateUpdated": "2024-08-16T18:48:47.441Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-03-27T16:58:22.583Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. \r\n\r This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "17.10.1", "status": "affected"}, {"version": "17.10.1a", "status": "affected"}, {"version": "17.10.1b", "status": "affected"}, {"version": "17.11.1", "status": "affected"}, {"version": "17.11.1a", "status": "affected"}, {"version": "17.12.1", "status": "affected"}, {"version": "17.12.1w", "status": "affected"}, {"version": "17.12.1a", "status": "affected"}, {"version": "17.11.99SW", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Handling of Parameters", "type": "cwe", "cweId": "CWE-233"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT", "name": "cisco-sa-iosxe-utd-cmd-JbL8KvHT"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-iosxe-utd-cmd-JbL8KvHT", "discovery": "INTERNAL", "defects": ["CSCwh05263"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:41.650Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT", "name": "cisco-sa-iosxe-utd-cmd-JbL8KvHT", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "cisco", "product": "ios_xe", "cpes": ["cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "17.10.1", "status": "affected"}, {"version": "17.10.1a", "status": "affected"}, {"version": "17.10.1b", "status": "affected"}, {"version": "17.11.1", "status": "affected"}, {"version": "17.11.1a", "status": "affected"}, {"version": "17.12.1", "status": "affected"}, {"version": "17.12.1w", "status": "affected"}, {"version": "17.12.1a", "status": "affected"}, {"version": "17.11.99SW", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-28T04:00:39.411568Z", "id": "CVE-2024-20306", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-16T18:48:47.441Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT", "name": "cisco-sa-iosxe-utd-cmd-JbL8KvHT", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:41.650Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20306", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-28T04:00:39.411568Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "ios_xe", "versions": [{"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.10.1a"}, {"status": "affected", "version": "17.10.1b"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.11.1a"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.1w"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.11.99SW"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-16T18:48:42.784Z"}}], "cna": {"source": {"defects": ["CSCwh05263"], "advisory": "cisco-sa-iosxe-utd-cmd-JbL8KvHT", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.10.1a"}, {"status": "affected", "version": "17.10.1b"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.11.1a"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.1w"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.11.99SW"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT", "name": "cisco-sa-iosxe-utd-cmd-JbL8KvHT"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. \r\n\r This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-233", "description": "Improper Handling of Parameters"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-03-27T16:58:22.583Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20306", "state": "PUBLISHED", "dateUpdated": "2024-08-16T18:48:47.441Z", "dateReserved": "2023-11-08T15:08:07.631Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-03-27T16:58:22.583Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. \r\n\r This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system."}, {"lang": "es", "value": "Una vulnerabilidad en la CLI de configuraci\u00f3n de Unified Threat Defense (UTD) del software Cisco IOS XE podr\u00eda permitir que un atacante local autenticado ejecute comandos arbitrarios como root en el sistema operativo host subyacente. Para aprovechar esta vulnerabilidad, un atacante debe tener privilegios de nivel 15 en el dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n de entrada insuficiente. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un comando CLI manipulado a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante ejecutar comandos arbitrarios como root en el sistema operativo subyacente."}], "id": "CVE-2024-20306", "lastModified": "2024-03-27T17:48:21.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2024-03-27T17:15:52.067", "references": [{"source": "ykramarz@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-233"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}