CVE-2023-20209

Description

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges.

Reserved 2022-10-27 | Published 2023-08-16 | Updated 2024-10-23 | Assigner cisco

Problem types

Improper Control of Generation of Code ('Code Injection')

Product status

X8.5.1
affected

X8.5.3
affected

X8.5
affected

X8.6.1
affected

X8.6
affected

X8.1.1
affected

X8.1.2
affected

X8.1
affected

X8.2.1
affected

X8.2.2
affected

X8.2
affected

X8.7.1
affected

X8.7.2
affected

X8.7.3
affected

X8.7
affected

X8.8.1
affected

X8.8.2
affected

X8.8.3
affected

X8.8
affected

X8.9.1
affected

X8.9.2
affected

X8.9
affected

X8.10.0
affected

X8.10.1
affected

X8.10.2
affected

X8.10.3
affected

X8.10.4
affected

X12.5.8
affected

X12.5.9
affected

X12.5.0
affected

X12.5.2
affected

X12.5.7
affected

X12.5.3
affected

X12.5.4
affected

X12.5.5
affected

X12.5.1
affected

X12.5.6
affected

X12.6.0
affected

X12.6.1
affected

X12.6.2
affected

X12.6.3
affected

X12.6.4
affected

X12.7.0
affected

X12.7.1
affected

X8.11.1
affected

X8.11.2
affected

X8.11.4
affected

X8.11.3
affected

X8.11.0
affected

X14.0.1
affected

X14.0.3
affected

X14.0.2
affected

X14.0.4
affected

X14.0.5
affected

X14.0.6
affected

X14.0.7
affected

X14.0.8
affected

X14.0.9
affected

X14.0.10
affected

X14.0.11
affected

X14.2.1
affected

X14.2.2
affected

X14.2.5
affected

X14.2.6
affected

X14.2.0
affected

X14.2.7
affected

X14.3.0
affected

References

sec.cloudapps.cisco.com/...-sa-expressway-injection-X475EbTQ (cisco-sa-expressway-injection-X475EbTQ)

cve.org (CVE-2023-20209)

nvd.nist.gov (CVE-2023-20209)

Download JSON