Vulnerability in Cisco Asyncos
CVE-2024-20435
A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this vulnerability by authenticating to the system and executing a crafted command on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least guest credentials.
EPSS: 0.002 (5.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Cisco Asyncos — versions 11.7.0-406, 11.7.0-418, 11.7.1-006
- Cisco Secure Web Appliance — versions 11.7.0-406, 11.7.0-418, 11.7.1-049
- Cisco Secure_web_appliance_s196
- Cisco Secure_web_appliance_s396
- Cisco Secure_web_appliance_s696
- Cisco Secure_web_appliance_virtual_s1000v
- Cisco Secure_web_appliance_virtual_s100v
- Cisco Secure_web_appliance_virtual_s300v
- Cisco Secure_web_appliance_virtual_s600v
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-20435?
- CVE-2024-20435 is a high-severity vulnerability in Cisco Asyncos, classified under CWE-250. CVSS score: 8.8/10. Published 2024-07-17.
- How severe is CVE-2024-20435?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-20435 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.