CVE-2024-20335
Assigner: cisco
Published: 2024-03-06T16:30:39.235Z
State: PUBLISHED
descriptions: value: A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacker to perform command injection attacks against an affected device. In order to exploit this vulnerability, the attacker must have valid administrative credentials for the device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system.
affected: vendor: Cisco
product: Cisco Business Wireless Access Point Software
versions: version: 1.0.0.13
status: affected
version: 1.0.0.16
status: affected
version: 1.0.0.3
status: affected
version: 1.0.0.4
status: affected
version: 1.0.0.5
status: affected
version: 1.0.0.7
status: affected
version: 1.0.1.2
status: affected
version: 1.0.1.3
status: affected
version: 1.0.1.5
status: affected
version: 1.0.1.6
status: affected
version: 1.0.1.7
status: affected
version: 1.0.2.0
status: affected
version: 1.0.3.1
status: affected
version: 1.0.4.4
status: affected
version: 1.0.4.3
status: affected
version: 1.0.1.10
status: affected
version: 1.0.5.0
status: affected
version: 1.0.0.10
status: affected
version: 1.0.0.12
status: affected
version: 1.0.0.14
status: affected
version: 1.0.0.15
status: affected
version: 1.0.0.17
status: affected
version: 1.0.0.9
status: affected
version: 1.0.1.11
status: affected
version: 1.0.1.12
status: affected
version: 1.0.1.9
status: affected
version: 1.0.2.6
status: affected
version: 1.1.0.5
status: affected
version: 1.1.0.7
status: affected
version: 1.1.0.9
status: affected
version: 1.1.1.0
status: affected
version: 1.1.2.4
status: affected
version: 1.1.4.6
status: affected
version: 1.1.3.2
status: affected
version: 1.1.4.0
status: affected
version: 1.1.0.3
status: affected
version: 1.1.0.4
status: affected
version: 1.1.0.6
status: affected
version: 1.1.2.3
status: affected
version: 1.2.0.2
status: affected
version: 1.2.0.3
status: affected
version: 1.2.1.3
status: affected
version: 1.3.0.3
status: affected
version: 1.3.0.4
status: affected
version: 1.3.0.6
status: affected
version: 1.3.0.7
status: affected
problemTypes: descriptions: description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
type: cwe
cweId: CWE-78
metrics: format: cvssV3_1
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
baseScore: 6.5
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
source: advisory: cisco-sa-sb-wap-multi-85G83CRB
discovery: EXTERNAL
defects: CSCwi78277
CSCwi83948
CSCwi78254
CSCwi78271