MEDIUM✓ PATCH🇬🇧 English

CVE-2023-20044

CVSS 6.7v3.1pub. 2023-01-20upd. 2024-11-21

A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by persuading support to update settings which call the insecure script. A successful exploit could allow the attacker to take complete control of the affected device.

oryginał EN
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

  • Cisco Cx Cloud Agent

    APP
    Cisco
    < 2.2.1
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
CWE
Referencje

Powiązane podatności

CVE-2022-22965CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+

CVE-2023-20043MEDIUM6.7ten sam produkt

A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privi...

CVE-2026-20182CRITICAL10.0⚠ KEVPL ✓ten sam vendor

Cisco Catalyst SD-WAN — pominięcie uwierzytelnienia z dostępem administracyjnym

CVE-2026-20131CRITICAL10.0⚠ KEVPL ✓ten sam vendor

RCE przez insecure deserialization w Cisco Secure Firewall Management Center

CVE-2026-20127CRITICAL10.0⚠ KEVPL ✓ten sam vendor

Cisco Catalyst SD-WAN — ominięcie uwierzytelnienia peering i przejęcie uprawnień