Cisco IOS XR Software Vulnerability Allows Elevation of Privileges

CVE-2024-20398

Summary

A vulnerability exists in the Command Line Interface (CLI) of Cisco IOS XR Software that enables an authenticated, local attacker to gain read/write file system access on the underlying operating system of the affected device. This issue stems from inadequate validation of user arguments associated with specific CLI commands. An attacker possessing a low-privileged account can exploit this vulnerability by executing specially crafted commands in the CLI prompt. Successful exploitation can permit the attacker to elevate their privileges to that of the root user, thereby compromising the integrity and security of the device.

References