Cisco AsyncOS for Secure Web Appliance Vulnerability: Arbitrary Command Execution and Privilege Escalation

CVE-2024-20435

Summary

A vulnerability exists in the command-line interface (CLI) of Cisco AsyncOS for Secure Web Appliance, which could permit an authenticated local attacker to execute arbitrary commands and elevate privileges to root level. This issue stems from inadequate validation of user-supplied input within the CLI, allowing a malicious actor to authenticate to the system and run a specially crafted command. Successful exploitation would result in the attacker gaining the ability to execute any commands on the underlying operating system and escalate their privileges to root. The exploitation requires at least guest-level credentials.

References