Command Execution Vulnerability in Cisco Prime Infrastructure

CVE-2023-20258

Summary

A security flaw exists in the web-based management interface of Cisco Prime Infrastructure that could enable an authenticated remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability arises from the inadequate processing of serialized Java objects within the application. Attacks may involve uploading a document imbued with malicious serialized Java objects that the application processes. If successfully exploited, this could permit the attacker to compel the application into executing unintended commands on the system, leading to potential unauthorized access and operational disruptions.

References