CVE-2023-20234

Опубликовано: 23 авг. 2023

Источник: nvd

CVSS3: 4.4

CVSS3: 6

EPSS Низкий

Описание

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an affected device, including system files.

The vulnerability occurs because there is no validation of parameters when a specific CLI command is used. An attacker could exploit this vulnerability by authenticating to an affected device and using the command at the CLI. A successful exploit could allow the attacker to overwrite any file on the disk of the affected device, including system files. The attacker must have valid administrative credentials on the affected device to exploit this vulnerability.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:cisco:firepower_extensible_operating_system:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:cisco:firepower_1000:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_1020:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_1030:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_1040:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_2100:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4110_next-generation_firewall:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4120_next-generation_firewall:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4140_next-generation_firewall:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_4150_next-generation_firewall:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_security_appliance:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-24:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-36:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-40:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-44:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-44_x_3:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-48:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-56:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_sm-56_x_3:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_with_1_sm-24_module:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_with_1_sm-36_module:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_with_1_sm-44_module:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:firepower_9300_with_3_sm-44_module:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:secure_firewall_3105:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:secure_firewall_3110:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:secure_firewall_3120:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:secure_firewall_3130:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:secure_firewall_3140:-:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00019

Низкий

4.4 Medium

CVSS3

6 Medium

CVSS3

Дефекты

CWE-73

CWE-732

Связанные уязвимости

GHSA-vgmc-qr4h-h4cx

CVSS3: 4.4

github

больше 2 лет назад

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an affected device, including system files. The vulnerability occurs because there is no validation of parameters when a specific CLI command is used. An attacker could exploit this vulnerability by authenticating to an affected device and using the command at the CLI. A successful exploit could allow the attacker to overwrite any file on the disk of the affected device, including system files. The attacker must have valid administrative credentials on the affected device to exploit this vulnerability.

BDU:2023-05577

CVSS3: 4.4

fstec

больше 2 лет назад

Уязвимость интерфейса командной строки операционной системы Cisco FX-OS устройств Cisco серии Firepower 1000, Firepower 2100, Firepower 4100, Firepower 9300 Security Appliances, Secure Firewall 3100 Series, позволяющая нарушителю создать файл или перезаписать любой файл в файловой системе

EPSS

Процентиль: 4%

0.00019

Низкий

4.4 Medium

CVSS3

6 Medium

CVSS3

Дефекты

CWE-73

CWE-732