CVE-2023-20260: CLI Arg Exploit in Cisco Prime INF & Evolved PM Enables Root
CVE-2023-20260 Published on January 17, 2024

A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.

NVD

Vulnerability Analysis

CVE-2023-20260 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2023-20260 has been classified to as an Authorization vulnerability or weakness.


Products Associated with CVE-2023-20260

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-20260 are published in these products:

Cisco Prime Infrastructure
 
Cisco Evolved Programmable Network Manager
 

Affected Versions

Cisco Prime Infrastructure: Cisco Evolved Programmable Network Manager (EPNM):

Exploit Probability

EPSS
0.02%
Percentile
5.27%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.