Command Injection Vulnerability in Cisco WAP371 Wireless Access Point

CVE-2024-20287

Summary

A security vulnerability exists in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point that could allow an authenticated remote attacker to perform command injection attacks. This issue arises from inadequate validation of user-supplied input, enabling a potential attacker with administrative credentials to craft and send malicious HTTP requests. If successfully exploited, this vulnerability grants the attacker the ability to execute arbitrary commands with root privileges, ultimately compromising the device's security and functionality. Safeguarding the management interface and ensuring secure administrative practices are crucial to mitigating this risk.

References