CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
5.1%
A vulnerability in the status-checking process of remote access tunnels for supporting Cisco Web Security Appliances (WSA) could allow an authenticated, local attacker to execute arbitrary Python code on the affected system.
The vulnerability is due to improper usage and handling of the pickle Python module by the affected software. An attacker could exploit this vulnerability by submitting a crafted pickle file to an affected device. A successful exploit could be used to conduct further attacks.
Cisco has confirmed the vulnerability; however, no software updates are available.
To exploit the vulnerability, the attacker must log in locally to the vulnerable device. The access requirement reduces the potential for exploitation.
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | web_security_appliance_\(wsa\) | any | cpe:2.3:a:cisco:web_security_appliance_\(wsa\):any:*:*:*:*:*:*:* |