CVE-2023-20097: cisco aironet_access_point_software Command Injection

Vulnerability summary

CVE-2023-20097 is a medium (CVSS 6.7) Command Injection vulnerability in cisco aironet_access_point_software. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.

Timeline

1. 23-03-2023
   PublishedVulnerability first disclosed.
2. 25-10-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.