Cisco Industrial Network Director Command Injection Vulnerability (Cisco Cisco Industrial Network Director)
At a glance
- Source
- NVD
- EPSS
- EPSS 13.78 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Analyzed
Description
A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITY\SYSTEM on the underlying operating system of an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | cisco |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · psirt@cisco.com (Secondary) |
European references
- ENISA EUVD · EUVD-2023-24215
- GCVE · GCVE-0-2023-20036
CERT-FR advisories
- CERTFR-2023-AVI-0327 — Multiples vulnérabilités dans les produits Cisco · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:cisco:industrial_network_director:*:*:*:*:*:*:*:*< 1.11.3
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Industrial Network Director | affected 1.3.1 ; affected 1.6.0 ; affected 1.7.0 ; affected 1.6.1 ; affected 1.5.1 ; affected 1.2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |