Unauthenticated Remote Code Execution Vulnerability in Cisco RCM for StarOS

CVE-2022-20649

Summary

The vulnerability in Cisco RCM for Cisco StarOS Software facilitates remote code execution due to debug mode being enabled for certain services. An attacker can exploit this weakness by connecting to the device and targeting the service with debug mode active. Once exploited, the attacker gains the ability to execute arbitrary commands with root privileges, potentially compromising the system's security. While unauthenticated attackers may perform detailed reconnaissance to gain access, authenticated users can also exploit this vulnerability. Cisco has implemented software updates that resolve this issue, and no workarounds are available.

References