CVE-2023-20097 : A vulnerability in Cisco access points (AP) software could allow an authenticate

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

Published 2023-03-23 17:15:15

Updated 2023-04-05 18:22:15

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2023-20097

Cisco » Ios Xe
Versions from including (>=) 17.1 and before (<) 17.3.6
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe
Versions from including (>=) 17.4 and before (<) 17.6.5
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe
Versions before (<) 16.12.8
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe
Versions from including (>=) 17.7 and before (<) 17.9.2
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
Cisco » Aironet Access Point Software
Versions before (<) 17.9.0.135
cpe:2.3:a:cisco:aironet_access_point_software:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Aironet 1540 » Version: N/A
When used together with: Cisco » Aironet 1542d » Version: N/A
When used together with: Cisco » Aironet 1542i » Version: N/A
When used together with: Cisco » Aironet 1560 » Version: N/A
When used together with: Cisco » Aironet 1562d » Version: N/A
When used together with: Cisco » Aironet 1562e » Version: N/A
When used together with: Cisco » Aironet 1562i » Version: N/A
When used together with: Cisco » Aironet 1800 » Version: N/A
When used together with: Cisco » Aironet 1800i » Version: N/A
When used together with: Cisco » Aironet 1810 » Version: N/A
When used together with: Cisco » Aironet 1810w » Version: N/A
When used together with: Cisco » Aironet 1815 » Version: N/A
When used together with: Cisco » Aironet 1815i » Version: N/A
When used together with: Cisco » Aironet 1815m » Version: N/A
When used together with: Cisco » Aironet 1815t » Version: N/A
When used together with: Cisco » Aironet 1815w » Version: N/A
When used together with: Cisco » Aironet 2800 » Version: N/A
When used together with: Cisco » Aironet 2800e » Version: N/A
When used together with: Cisco » Aironet 2800i » Version: N/A
When used together with: Cisco » Aironet 3800 » Version: N/A
When used together with: Cisco » Aironet 3800e » Version: N/A
When used together with: Cisco » Aironet 3800i » Version: N/A
When used together with: Cisco » Aironet 3800p » Version: N/A
When used together with: Cisco » Aironet 4800 » Version: N/A
When used together with: Cisco » Catalyst 9100 » Version: N/A
When used together with: Cisco » Catalyst 9105 » Version: N/A
When used together with: Cisco » Catalyst 9105ax » Version: N/A
When used together with: Cisco » Catalyst 9105axi » Version: N/A
When used together with: Cisco » Catalyst 9105axw » Version: N/A
When used together with: Cisco » Catalyst 9115 » Version: N/A
When used together with: Cisco » Catalyst 9115 Ap » Version: N/A
When used together with: Cisco » Catalyst 9115ax » Version: N/A
When used together with: Cisco » Catalyst 9115axe » Version: N/A
When used together with: Cisco » Catalyst 9115axi » Version: N/A
When used together with: Cisco » Catalyst 9117 » Version: N/A
When used together with: Cisco » Catalyst 9117 Ap » Version: N/A
When used together with: Cisco » Catalyst 9117ax » Version: N/A
When used together with: Cisco » Catalyst 9117axi » Version: N/A
When used together with: Cisco » Catalyst 9120 » Version: N/A
When used together with: Cisco » Catalyst 9120 Ap » Version: N/A
When used together with: Cisco » Catalyst 9120ax » Version: N/A
When used together with: Cisco » Catalyst 9120axe » Version: N/A
When used together with: Cisco » Catalyst 9120axi » Version: N/A
When used together with: Cisco » Catalyst 9120axp » Version: N/A
When used together with: Cisco » Catalyst 9124 » Version: N/A
When used together with: Cisco » Catalyst 9124ax » Version: N/A
When used together with: Cisco » Catalyst 9124axd » Version: N/A
When used together with: Cisco » Catalyst 9124axi » Version: N/A
When used together with: Cisco » Catalyst 9130 » Version: N/A
When used together with: Cisco » Catalyst 9130 Ap » Version: N/A
When used together with: Cisco » Catalyst 9130ax » Version: N/A
When used together with: Cisco » Catalyst 9130axe » Version: N/A
When used together with: Cisco » Catalyst 9130axi » Version: N/A
When used together with: Cisco » Catalyst Iw6300 » Version: N/A
When used together with: Cisco » Catalyst Iw6300 Ac » Version: N/A
When used together with: Cisco » Catalyst Iw6300 Dc » Version: N/A
When used together with: Cisco » Catalyst Iw6300 Dcw » Version: N/A
Cisco » Wireless Lan Controller Software
Versions before (<) 8.10.183.0
cpe:2.3:a:cisco:wireless_lan_controller_software:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Esw6300 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-20097

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-20097

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	1.5	2.7	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-20097

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2023-20097

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8

Cisco Access Point Software Command Injection Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-20097

Products affected by CVE-2023-20097

Exploit prediction scoring system (EPSS) score for CVE-2023-20097

CVSS scores for CVE-2023-20097

CWE ids for CVE-2023-20097

References for CVE-2023-20097