CVE-2023-20035 : A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authen

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges. This vulnerability is due to insufficient input validation by the system CLI. An attacker with privileges to run commands could exploit this vulnerability by first authenticating to an affected device using either local terminal access or a management shell interface and then submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges. An attacker with limited user privileges could use this vulnerability to gain complete control over the system. Note: For additional information about specific impacts, see the Details section of this advisory.

Published 2023-03-23 17:15:14

Updated 2023-05-22 18:57:25

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2023-20035

Cisco » Ios Xe Sd-wan » Version: N/A
cpe:2.3:o:cisco:ios_xe_sd-wan:-:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 8000v Edge » Version: N/A
When used together with: Cisco » 1100-4g/6g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100 Integrated Services Router » Version: N/A
When used together with: Cisco » 1101-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1101 Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-2p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109 Integrated Services Router » Version: N/A
When used together with: Cisco » 1120 Integrated Services Router » Version: N/A
When used together with: Cisco » 1131 Integrated Services Router » Version: N/A
When used together with: Cisco » 1160 Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4451-x Integrated Services Router » Version: N/A
When used together with: Cisco » 4451 Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » Asr 1001-x » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Catalyst 8200 » Version: N/A
When used together with: Cisco » Catalyst 8300 » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-6t » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-6t » Version: N/A
When used together with: Cisco » Catalyst 8500 » Version: N/A
When used together with: Cisco » Catalyst 8500-4qc » Version: N/A
When used together with: Cisco » Catalyst 8500l » Version: N/A
When used together with: Cisco » Catalyst 8510csr » Version: N/A
When used together with: Cisco » Catalyst 8510msr » Version: N/A
When used together with: Cisco » Catalyst 8540csr » Version: N/A
When used together with: Cisco » Catalyst 8540msr » Version: N/A
When used together with: Cisco » Csr 1000v » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-20035

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-20035

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-20035

CWE-146 Improper Neutralization of Expression/Command Delimiters

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2023-20035

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw

Cisco IOS XE SD-WAN Software Command Injection Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-20035

Products affected by CVE-2023-20035

Exploit prediction scoring system (EPSS) score for CVE-2023-20035

CVSS scores for CVE-2023-20035

CWE ids for CVE-2023-20035

References for CVE-2023-20035