1. Home
  2. CVE Database
  3. CVE-2023-20097
MEDIUM · 4.6

CVE-2023-20097

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to impro...

Vulnerability Description

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

CVSS Score

4.6

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
CiscoWireless Lan Controller Software< 8.10.183.0
CiscoEsw6300-
CiscoAironet Access Point Software< 17.9.0.135
CiscoAironet 1540-
CiscoAironet 1542D-
CiscoAironet 1542I-
CiscoAironet 1560-
CiscoAironet 1562D-
CiscoAironet 1562E-
CiscoAironet 1562I-
CiscoAironet 1800-
CiscoAironet 1800I-
CiscoAironet 1810-
CiscoAironet 1810W-
CiscoAironet 1815-
CiscoAironet 1815I-
CiscoAironet 1815M-
CiscoAironet 1815T-
CiscoAironet 1815W-
CiscoAironet 2800-

Related Weaknesses (CWE)

CWE-77

References

FAQ

What is CVE-2023-20097?

CVE-2023-20097 is a vulnerability with a CVSS score of 4.6 (MEDIUM). A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to impro...

How severe is CVE-2023-20097?

CVE-2023-20097 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-20097?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Wireless Lan Controller Software, Cisco Esw6300, Cisco Aironet Access Point Software, Cisco Aironet 1540, Cisco Aironet 1542D.