10.0
Critical
CVE-2024-20418 A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco…
Description
A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated, remote attacker to perform command injection attacks with root privileges on the underlying operating system. This vulnerability is due to improper validation of input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Aironet Access Point Software (IOS XE Controller) | Versions not published | |
| aironet_access_point_software 17.14 | earliest → 17.14 | No fix stated |
References
- cisco-sa-backhaul-ap-cmdinj-R7E28Ecs sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco Aironet Access Point Software (IOS XE Controller)
The 11 CVEs of Cisco Aironet Access Point Software (IOS XE Controller) →
CVE-2025-20365
A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an…
4.3
Medium
CVE-2025-20364
A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow…
4.3
Medium
CVE-2024-20271
A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote…
8.6
High
CVE-2024-20265
A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical…
5.9
Medium