Skip to content
Sign in
8.8 High

CVE-2024-20435 A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to…

Description

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this vulnerability by authenticating to the system and executing a crafted command on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least guest credentials.

Affected products and versions

Product Affected versions Fixed in
Cisco Secure Web Appliance 15.1.0-287 No fix stated
Cisco Secure Web Appliance 15.0 15.0.0-322 → 15.0.0-355 No fix stated
Cisco Secure Web Appliance 14.5 14.5.0-498 → 14.5.2-011 No fix stated
Cisco Secure Web Appliance 14.0 14.0.2-012 → 14.0.5-007 No fix stated
Cisco Secure Web Appliance 12.5 12.5.1-011 → 12.5.6-008 No fix stated
Cisco Secure Web Appliance 12.0 12.0.1-268 → 12.0.3-007 No fix stated
Cisco Secure Web Appliance 11.8 11.8.0-414 → 11.8.3-021 No fix stated
Cisco Secure Web Appliance 11.7 11.7.0-406 → 11.7.2-011 No fix stated
secure_web_appliance 15.1.0-287 No fix stated
Show the 7 other branches
Product Affected versions Fixed in
secure_web_appliance 15.0 15.0.0-322 → 15.0.0-355 No fix stated
secure_web_appliance 14.5 14.5.0-498 → 14.5.2-011 No fix stated
secure_web_appliance 14.0 14.0.2-012 → 14.0.5-007 No fix stated
secure_web_appliance 12.5 12.5.1-011 → 12.5.6-008 No fix stated
secure_web_appliance 12.0 12.0.1-268 → 12.0.3-007 No fix stated
secure_web_appliance 11.8 11.8.0-414 → 11.8.3-021 No fix stated
secure_web_appliance 11.7 11.7.0-406 → 11.7.2-011 No fix stated

Other CVEs of Cisco Secure Web Appliance

The 15 CVEs of Cisco Secure Web Appliance →
CVE-2026-20152 A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could… 5.3 Medium CVE-2026-20056 A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco… 4.0 Medium CVE-2025-20207 A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco… 4.3 Medium CVE-2025-20185 A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure… 3.4 Low
Track this CVE