A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.
ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2020-3259 is an information disclosure vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) affecting certain AnyConnect and WebVPN configurations. The flaw allows an attacker to retrieve memory contents due to a buffer tracking issue when parsing invalid URLs via the web services interface. This could lead to exposure of confidential information. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit this vulnerability, the attacker must have valid administrative credentials for the device.
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper processing of serialized Java objects by the affected application. An attacker could exploit this vulnerability by uploading a document containing malicious serialized Java objects to be processed by the affected application. A successful exploit could allow the attacker to cause the application to execute arbitrary commands.
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system.
These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.
CVE-2023-20175 is a high-severity OS command injection vulnerability in Cisco Identity Services Engine (ISE) software. It allows an authenticated local attacker with at least read-only privileges to execute arbitrary OS commands and escalate privileges to root by exploiting insufficient input validation in a specific CLI command. The vulnerability affects multiple versions of Cisco ISE from 2.6.0 through 3.2.0. Exploitation requires valid credentials but no user interaction beyond command submission. The vulnerability can compromise confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.
CVE-2023-20170 is a command injection vulnerability in Cisco Identity Services Engine (ISE) software that allows an authenticated local attacker with Administrator privileges to execute arbitrary commands on the underlying OS and escalate privileges to root. Exploitation requires valid admin credentials and involves submitting a crafted CLI command due to insufficient input validation. The vulnerability has a CVSS score of 6.0, indicating medium severity, with high impact on confidentiality and integrity but no impact on availability. No known exploits are currently reported in the wild. European organizations using Cisco ISE for network access control and policy enforcement could face risks if attackers gain admin access. Mitigation requires Cisco patches or strict administrative access controls and input validation. Countries with significant Cisco ISE deployments and critical infrastructure relying on network access control are most at risk.
CVE-2023-20063 is a high-severity code injection vulnerability affecting Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) devices. It allows an authenticated local attacker with administrative privileges on either FMC or FTD to execute arbitrary commands with root privileges on the paired device. The vulnerability arises from insufficient validation of user-supplied input in inter-device communication, enabling command injection via expert mode. Exploitation requires high privileges and no user interaction but can lead to full system compromise, impacting confidentiality, integrity, and availability. There are no known exploits in the wild yet, but the broad range of affected versions and critical access level make timely patching essential. European organizations using Cisco Firepower solutions in critical infrastructure or enterprise networks are at risk. Mitigation involves applying Cisco patches when available, restricting administrative access, and monitoring for anomalous expert mode activity. Countries with significant Cisco Firepower deployments and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2023-20048 is a critical vulnerability in Cisco Firepower Management Center (FMC) that allows an authenticated remote attacker with valid credentials to execute unauthorized configuration commands on managed Firepower Threat Defense (FTD) devices. The flaw arises from insufficient authorization checks in the FMC web services interface, enabling privilege escalation within the network defense infrastructure. Exploitation requires no user interaction but does require valid FMC credentials. The vulnerability impacts a wide range of FMC versions from 6.2.3 through 7.3.1.1. Successful exploitation could compromise confidentiality and availability by allowing attackers to alter device configurations, potentially disrupting network security controls.
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
CVE-2023-20101 is a critical vulnerability in Cisco Emergency Responder version 12.5(1)SU4 that involves hard-coded root credentials. An unauthenticated remote attacker can exploit this flaw to log in as root using static, unchangeable credentials embedded in the system. This allows full control over the affected device, enabling arbitrary command execution with root privileges. The vulnerability stems from development-only static credentials that were never removed or disabled in production releases. The CVSS score is 9.8, reflecting the high impact and ease of exploitation without authentication or user interaction. Although no known exploits are currently reported in the wild, the risk is severe given the critical nature of the affected systems. Cisco Emergency Responder is widely used in enterprise telephony and emergency call management, making this vulnerability particularly impactful. European organizations relying on Cisco telephony infrastructure could face significant confidentiality, integrity, and availability risks if exploited.
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.
This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.
CVE-2023-20186 is a high-severity vulnerability in Cisco IOS and IOS XE software affecting the Authentication, Authorization, and Accounting (AAA) feature. An authenticated attacker with level 15 privileges can exploit improper authorization in SCP command processing to bypass command authorization. This allows unauthorized copying of files to or from the device's file system, potentially leading to configuration disclosure or modification. Exploitation requires valid credentials and no user interaction. The vulnerability impacts confidentiality, integrity, and availability of affected devices. It affects a wide range of Cisco IOS versions, many of which are commonly deployed in enterprise and service provider networks. No known exploits are currently reported in the wild, but the potential impact is significant. European organizations relying on Cisco IOS devices should prioritize patching and access controls to mitigate risk. Countries with large telecom infrastructure and enterprise deployments of Cisco gear are most at risk.
CVE-2023-20231 is a high-severity OS command injection vulnerability in the web UI of Cisco IOS XE Software. It allows an authenticated remote attacker with Lobby Ambassador account credentials to execute arbitrary CLI commands at privilege level 15 due to insufficient input validation. The vulnerability affects numerous IOS XE versions across the 16.12, 17.x, and 17.9 branches. Exploitation does not require user interaction but does require valid credentials for a non-default account. No known exploits are currently reported in the wild. The vulnerability poses significant risks to confidentiality, integrity, and availability of affected devices and networks.
CVE-2023-20252 is a critical vulnerability in Cisco SD-WAN vManage affecting versions 20.9.3.2 and 20.11.1.2. It stems from missing authorization checks in the SAML APIs, allowing unauthenticated remote attackers to gain unauthorized access as arbitrary users. Exploitation requires no authentication or user interaction and can lead to full compromise of confidentiality, integrity, and availability of the SD-WAN management platform. The vulnerability has a CVSS score of 9.
