Arbitrary File Read and Write Vulnerability in Cisco ConfD and Crosswork Network Services Orchestrator CLI

CVE-2024-20389

What is CVE-2024-20389?

A vulnerability exists in the ConfD CLI and Cisco Crosswork Network Services Orchestrator CLI, allowing a local, authenticated attacker with low privileges to manipulate arbitrary files on the operating system. This issue arises from improper authorization enforcement when certain command-line interface (CLI) commands are executed. By utilizing crafted command arguments, an attacker can exploit this vulnerability to read or write files with root user privileges, potentially leading to unauthorized access or system compromise.

References