OS Command Injection in Cisco Systems, Inc products - CVE-2024-20483

Vulnerability identifier: #VU97229

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20483

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Routed Passive Optical Network (PON) Controller Software
NCS 540-24Q8L2DD-SYS Router
NCS 540-24Z8Q2C-SYS Router
NCS 540-28Z4C-SYS-A Router
NCS 540-28Z4C-SYS-D Router
NCS 540-ACC-SYS Router
NCS 540X-16Z4G8Q2C-A Router
NCS 540X-16Z4G8Q2C-D Router
NCS 55A1-24Q6H-SS
NCS 55A2-MOD-SE-S
Cisco Network Convergence System NCS-57C1-48Q6-SYS
NCS 57C3-MOD

Install updates from vendor's website.

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL

• Multiple vulnerabilities in Cisco Routed Passive Optical Network (PON) Controller Software