CVE-2023-20075

2023-02-1615:25:34

cisco

www.cve.org

vulnerability

cisco

secure email gateway

cli

input validation

remote attacker

arbitrary commands

exploit

operating system commands

administrator credentials

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

0.0005 Low

EPSS

Percentile

17.6%

JSON

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands.

These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Secure Email",
    "versions": [
      {
        "version": "13.0.0-392",
        "status": "affected"
      },
      {
        "version": "13.5.1-277",
        "status": "affected"
      },
      {
        "version": "12.5.0-066",
        "status": "affected"
      },
      {
        "version": "14.0.0-698",
        "status": "affected"
      },
      {
        "version": "14.2.0-620",
        "status": "affected"
      }
    ]
  }
]