CVE-2024-20483

Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager MongoDB instance to perform command injection attacks on the PON Controller container and execute arbitrary commands as root. These vulnerabilities are due to insufficient validation of arguments that are passed to specific configuration commands. An attacker could exploit these vulnerabilities by including crafted input as the argument of an affected configuration command. A successful exploit could allow the attacker to execute arbitrary commands as root on the PON controller.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:ios_xr:24.1.1:::::::*
	cpe:2.3:o:cisco:ios_xr:24.1.2:::::::*
	cpe:2.3:o:cisco:ios_xr:24.2.1:::::::*
	cpe:2.3:o:cisco:ios_xr:24.2.11:::::::*
	cpe:2.3:o:cisco:ios_xr:24.3.1:::::::*

History

No history.

Information

Published : 2024-09-11 17:15

Updated : 2024-10-03 01:44

NVD link : CVE-2024-20483

Mitre link : CVE-2024-20483

CVE.ORG link : CVE-2024-20483

JSON object : View

Products Affected

cisco

ios_xr

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2024-20483", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-09-11T17:15:13.213", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager MongoDB instance to perform command injection attacks on the PON Controller container and execute arbitrary commands as root.\r\n\r\nThese vulnerabilities are due to insufficient validation of arguments that are passed to specific configuration commands. An attacker could exploit these vulnerabilities by including crafted input as the argument of an affected configuration command. A successful exploit could allow the attacker to execute arbitrary commands as root on the PON controller."}, {"lang": "es", "value": "Varias vulnerabilidades en el software Cisco Routed PON Controller, que se ejecuta como un contenedor Docker en hardware compatible con el software Cisco IOS XR, podr\u00edan permitir que un atacante remoto autenticado con privilegios de nivel de administrador en el administrador de PON o acceso directo a la instancia MongoDB del administrador de PON realice ataques de inyecci\u00f3n de comandos en el contenedor del controlador de PON y ejecute comandos arbitrarios como superusuario. Estas vulnerabilidades se deben a una validaci\u00f3n insuficiente de los argumentos que se pasan a comandos de configuraci\u00f3n espec\u00edficos. Un atacante podr\u00eda aprovechar estas vulnerabilidades al incluir una entrada manipulada como argumento de un comando de configuraci\u00f3n afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar comandos arbitrarios como superusuario en el controlador de PON."}], "lastModified": "2024-10-03T01:44:17.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:24.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCE8E968-111F-4F57-93D3-E509AB540B87"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B342A550-8600-45CF-8B9A-530770C9A0F4"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D64E1C4D-46B0-4A18-B8EE-BEA732CBF1F8"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.2.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11288A28-F0CF-4FEC-A0B7-3D93866F01FE"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:24.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FD120B9-0671-473C-8420-872E5BB9933F"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}