Directory Traversal Vulnerability in Cisco Duo Device Health Application for Windows

CVE-2023-20229

What is CVE-2023-20229?

A vulnerability in the CryptoService function of the Cisco Duo Device Health Application for Windows enables low-privilege authenticated local attackers to exploit insufficient input validation. By executing a directory traversal attack, an attacker can overwrite arbitrary files on the affected system using a cryptographic key, potentially leading to denial of service (DoS) or data loss.

References