CVE-2023-20075: Cisco Secure Email Gateway CLI Command Injection
CVE-2023-20075 Published on March 1, 2023
Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.
Vulnerability Analysis
CVE-2023-20075 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Command Injection Vulnerability?
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2023-20075 has been classified to as a Command Injection vulnerability or weakness.
Products Associated with CVE-2023-20075
stack.watch emails you whenever new vulnerabilities are published in Cisco Email Security Appliance or Cisco Secure Email Gateway. Just hit a watch button to start following.
Affected Versions
Cisco Secure Email:- Version 13.0.0-392 is affected.
- Version 13.5.1-277 is affected.
- Version 12.5.0-066 is affected.
- Version 14.0.0-698 is affected.
- Version 14.2.0-620 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.