Cisco Routed PON Controller Software Vulnerabilities Allow Command Injection and Root Access

CVE-2024-20483

Summary

The Cisco Routed PON Controller Software, executed within a Docker container leveraging Cisco IOS XR Software, is susceptible to multiple vulnerabilities that could be exploited by attackers with Administrator-level access on the PON Manager. Insufficient validation of arguments in specific configuration commands allows these vulnerabilities to be leveraged for command injection attacks. By supplying specially crafted inputs to affected command arguments, an attacker can execute arbitrary commands as root within the PON controller container. This can result in significant security risks, emphasizing the importance of proper security measures and consistent patch management.

References