#VU68971 Absolute Path Traversal in BroadWorks CommPilot Application Software - CVE-2022-20951

Vulnerability identifier: #VU68971

Vulnerability risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-20951

CWE-ID: CWE-36

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
BroadWorks CommPilot Application Software
Server applications / Other server solutions

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote user to execute arbitrary commands on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the web-based management interface. A remote authenticated user can send a specially crafted HTTP request and execute arbitrary OS commands on the device as the bworks user.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

BroadWorks CommPilot Application Software: before 23.0.1075

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-ssrf-BJeQfpp
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd06681
https://www.shielder.com/advisories/cisco-broadworks-commpilot-ssrf/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.