Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2024-20343 |
CWE-ID | CWE-284 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
Cisco IOS XR Operating systems & Components / Operating system |
Vendor | Cisco Systems, Inc |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU97199
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-20343
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper validation of arguments passed to a certain CLI command. A local user can bypass implemented security restrictions and read arbitrary files on the system.
Install updates from vendor's website.
Vulnerable software versionsCisco IOS XR: 7.0 - 24.1
CPE2.3http://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-shellutil-HCb278wD
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi71881
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.