CVE-2023-20050CWE-78

Cisco NX-OS Software CLI Command Injection Vulnerability

Medium · published February 23, 2023

CVSS v3.1
4.4
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-02-23T00:00Z
EPSS history
Timeline
  • 23 FEB 00:00Z
    Cisco NX-OS Software CLI Command Injection Vulnerability
    cvelistv5