var-202302-0213
Vulnerability from variot
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system. Cisco IC3000 industrial computing gateway firmware, Cisco IOx , Cisco IOS XE Several Cisco Systems products include OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Iox is a secure development environment of Cisco (Cisco), which combines Cisco IOS and Linux OS for secure network connection and development of IOT applications. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-8whGn5dL
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202302-0213", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m2a" }, { "model": "ic3000 industrial compute gateway", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "1.4.2" }, { "model": "829 industrial integrated services router", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m4a" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m4" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m3" }, { "model": "ios xe", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "17.6.5" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m2" }, { "model": "ios xe", "scope": "gte", "trust": 1.0, "vendor": "cisco", "version": "17.9.0" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m6b" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m1" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m5" }, { "model": "cgr1000", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "1.16.0.1" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m2a" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m6a" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m4" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m4a" }, { "model": "cgr1240", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "1.16.0.1" }, { "model": "807 industrial integrated services router", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m3" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m4" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m6a" }, { "model": "iox", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": null }, { "model": "ir510 wpan", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "1.10.0.1" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m6b" }, { "model": "ios xe", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "17.9.2" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m" }, { "model": "809 industrial integrated services router", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)" }, { "model": "807 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m6a" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m2" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m1" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m5" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m2a" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m2" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m6b" }, { "model": "ios xe", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "17.10.0" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m1" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m4a" }, { "model": "809 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m3" }, { "model": "829 industrial integrated services router", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "15.9\\(3\\)m5" }, { "model": "cisco 1240 connected grid \u30eb\u30fc\u30bf", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco ic3000 \u7523\u696d\u7528\u30b3\u30f3\u30d4\u30e5\u30fc\u30c6\u30a3\u30f3\u30b0 \u30b2\u30fc\u30c8\u30a6\u30a7\u30a4", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco ios xe", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco 1000 \u30b7\u30ea\u30fc\u30ba connected grid \u30eb\u30fc\u30bf", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco 829 \u7523\u696d\u7528\u30b5\u30fc\u30d3\u30b9\u7d71\u5408\u578b\u30eb\u30fc\u30bf", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco ir510 wpan", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco 807 \u7523\u696d\u7528\u30b5\u30fc\u30d3\u30b9\u7d71\u5408\u578b\u30eb\u30fc\u30bf", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco 809 \u7523\u696d\u7528\u30b5\u30fc\u30d3\u30b9\u7d71\u5408\u578b\u30eb\u30fc\u30bf", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null }, { "model": "cisco iox", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "NVD", "id": "CVE-2023-20076" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:ic3000_industrial_compute_gateway:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.4.2", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:17.10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "17.9.2", "versionStartIncluding": "17.9.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:iox:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "17.6.5", "vulnerable": true } ], "operator": "OR" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:cgr1240_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.16.0.1", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:cgr1240:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:cgr1000_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.16.0.1", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:cgr1000:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:ir510_wpan_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.10.0.1", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:ir510_wpan:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "15.9\\(3\\)", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m2a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m4a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m6a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:829_industrial_integrated_services_router_firmware:15.9\\(3\\)m6b:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:829_industrial_integrated_services_router:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "15.9\\(3\\)", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m2a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m4a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m6a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:807_industrial_integrated_services_router_firmware:15.9\\(3\\)m6b:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:807_industrial_integrated_services_router:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "15.9\\(3\\)", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m2a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m4a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m6a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:809_industrial_integrated_services_router_firmware:15.9\\(3\\)m6b:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:cisco:809_industrial_integrated_services_router:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2023-20076" } ] }, "cve": "CVE-2023-20076", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "ykramarz@cisco.com", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.2, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 8.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2023-20076", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2023-20076", "trust": 1.8, "value": "HIGH" }, { "author": "ykramarz@cisco.com", "id": "CVE-2023-20076", "trust": 1.0, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202302-157", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "NVD", "id": "CVE-2023-20076" }, { "db": "NVD", "id": "CVE-2023-20076" }, { "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system. Cisco IC3000 industrial computing gateway firmware, Cisco IOx , Cisco IOS XE Several Cisco Systems products include OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Iox is a secure development environment of Cisco (Cisco), which combines Cisco IOS and Linux OS for secure network connection and development of IOT applications. \nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-8whGn5dL", "sources": [ { "db": "NVD", "id": "CVE-2023-20076" }, { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "CNNVD", "id": "CNNVD-202302-157" }, { "db": "VULHUB", "id": "VHN-444868" }, { "db": "VULMON", "id": "CVE-2023-20076" } ], "trust": 2.34 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2023-20076", "trust": 3.4 }, { "db": "JVNDB", "id": "JVNDB-2023-004067", "trust": 0.8 }, { "db": "AUSCERT", "id": "ESB-2023.0608", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202302-157", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-444868", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2023-20076", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-444868" }, { "db": "VULMON", "id": "CVE-2023-20076" }, { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "NVD", "id": "CVE-2023-20076" }, { "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "id": "VAR-202302-0213", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-444868" } ], "trust": 0.75144232 }, "last_update_date": "2023-12-18T13:11:36.407000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "cisco-sa-iox-8whGn5dL", "trust": 0.8, "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-iox-8whgn5dl" }, { "title": "Cisco Iox Fixes for operating system command injection vulnerabilities", "trust": 0.6, "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=226416" }, { "title": "Cisco: Cisco IOx Application Hosting Environment Command Injection Vulnerability", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-iox-8whgn5dl" } ], "sources": [ { "db": "VULMON", "id": "CVE-2023-20076" }, { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-78", "trust": 1.1 }, { "problemtype": "OS Command injection (CWE-78) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "VULHUB", "id": "VHN-444868" }, { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "NVD", "id": "CVE-2023-20076" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.8, "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-iox-8whgn5dl" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-20076" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2023-20076/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2023.0608" } ], "sources": [ { "db": "VULHUB", "id": "VHN-444868" }, { "db": "VULMON", "id": "CVE-2023-20076" }, { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "NVD", "id": "CVE-2023-20076" }, { "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-444868" }, { "db": "VULMON", "id": "CVE-2023-20076" }, { "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "db": "NVD", "id": "CVE-2023-20076" }, { "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-02-12T00:00:00", "db": "VULHUB", "id": "VHN-444868" }, { "date": "2023-10-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "date": "2023-02-12T04:15:19.287000", "db": "NVD", "id": "CVE-2023-20076" }, { "date": "2023-02-02T00:00:00", "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-02-22T00:00:00", "db": "VULHUB", "id": "VHN-444868" }, { "date": "2023-10-26T01:29:00", "db": "JVNDB", "id": "JVNDB-2023-004067" }, { "date": "2023-11-07T04:05:57.277000", "db": "NVD", "id": "CVE-2023-20076" }, { "date": "2023-02-23T00:00:00", "db": "CNNVD", "id": "CNNVD-202302-157" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202302-157" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "on multiple Cisco Systems products. \u00a0OS\u00a0 Command injection vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-004067" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "operating system commend injection", "sources": [ { "db": "CNNVD", "id": "CNNVD-202302-157" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.