Arbitrary File Read and Write Vulnerability in Cisco ConfD and Crosswork Network Services Orchestrator CLI

CVE-2024-20326

What is CVE-2024-20326?

A vulnerability exists in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI, enabling an authenticated, low-privileged local attacker to gain unauthorized access to critical files on the underlying operating system. The issue arises from improper authorization enforcement associated with certain CLI commands, allowing for crafted command arguments to circumvent security measures. Consequently, this could lead to unauthorized reading or writing of arbitrary files with root user privileges, posing significant risks to system integrity and confidentiality.

References