#VU97229 OS Command Injection in Cisco Systems, Inc products - CVE-2024-20483

Vulnerability identifier: #VU97229

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-20483

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Routed Passive Optical Network (PON) Controller Software
NCS 540-24Q8L2DD-SYS Router
NCS 540-24Z8Q2C-SYS Router
NCS 540-28Z4C-SYS-A Router
NCS 540-28Z4C-SYS-D Router
NCS 540-ACC-SYS Router
NCS 540X-16Z4G8Q2C-A Router
NCS 540X-16Z4G8Q2C-D Router
NCS 55A1-24Q6H-SS
NCS 55A2-MOD-SE-S
Cisco Network Convergence System NCS-57C1-48Q6-SYS
NCS 57C3-MOD

Software vendor:
Cisco Systems, Inc

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL