Vulnerability · Published Mar 23, 2023 · Assigned by cisco

CVE-2023-20097Cisco Access Point Software Command Injection Vulnerability

Medium 4.6

In plain English

A medium-severity command injection in Cisco Aironet Access Point Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Aironet Access Point Software	n/a

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

References

20230322 Cisco Access Point Software Command Injection Vulnerability vendor-advisory