Cisco IOS XR CLI Authenticated Local File Read via Improper Argument Validation
CVE-2024-20343 Published on September 11, 2024
Cisco IOS XR Software CLI Arbitrary File Read Vulnerability
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device.
This vulnerability is due to incorrect validation of the arguments that are passed to a specific CLI command. An attacker could exploit this vulnerability by logging in to an affected device with low-privileged credentials and using the affected command. A successful exploit could allow the attacker access files in read-only mode on the Linux file system.
Vulnerability Analysis
CVE-2024-20343 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2024-20343 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2024-20343
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20343 are published in Cisco Ios Xr:
Affected Versions
Cisco IOS XR Software:- Version 6.5.3 is affected.
- Version 6.6.1 is affected.
- Version 6.5.2 is affected.
- Version 6.5.92 is affected.
- Version 6.5.1 is affected.
- Version 6.5.15 is affected.
- Version 6.6.2 is affected.
- Version 7.0.1 is affected.
- Version 6.6.25 is affected.
- Version 6.6.11 is affected.
- Version 6.5.93 is affected.
- Version 6.6.12 is affected.
- Version 7.0.0 is affected.
- Version 7.1.1 is affected.
- Version 7.0.90 is affected.
- Version 6.6.3 is affected.
- Version 7.0.2 is affected.
- Version 7.1.15 is affected.
- Version 7.2.0 is affected.
- Version 7.2.1 is affected.
- Version 7.1.2 is affected.
- Version 7.0.11 is affected.
- Version 7.0.12 is affected.
- Version 7.0.14 is affected.
- Version 7.1.25 is affected.
- Version 6.6.4 is affected.
- Version 7.2.12 is affected.
- Version 7.3.1 is affected.
- Version 7.1.3 is affected.
- Version 7.4.1 is affected.
- Version 7.2.2 is affected.
- Version 7.3.15 is affected.
- Version 7.3.16 is affected.
- Version 7.4.15 is affected.
- Version 7.3.2 is affected.
- Version 7.5.1 is affected.
- Version 7.4.16 is affected.
- Version 7.3.27 is affected.
- Version 7.6.1 is affected.
- Version 7.5.2 is affected.
- Version 7.8.1 is affected.
- Version 7.6.15 is affected.
- Version 7.5.12 is affected.
- Version 7.8.12 is affected.
- Version 7.3.3 is affected.
- Version 7.7.1 is affected.
- Version 7.3.4 is affected.
- Version 7.4.2 is affected.
- Version 7.6.2 is affected.
- Version 7.5.3 is affected.
- Version 7.7.2 is affected.
- Version 7.9.1 is affected.
- Version 7.10.1 is affected.
- Version 7.8.2 is affected.
- Version 7.5.4 is affected.
- Version 7.8.22 is affected.
- Version 7.7.21 is affected.
- Version 7.9.2 is affected.
- Version 7.3.5 is affected.
- Version 7.5.5 is affected.
- Version 7.11.1 is affected.
- Version 7.9.21 is affected.
- Version 7.10.2 is affected.
- Version 24.1.1 is affected.
- Version 7.3.6 is affected.
- Version 7.5.52 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.