4.7
Medium
CVE-2026-20350 A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an…
Description
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by saving configuration details that contain malicious values. A successful exploit could allow the attacker to execute arbitrary operating system commands with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco ThousandEyes Enterprise Agent | Versions not published |
References
- cisco-sa-teva-os-command-W4GAO6jp sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco ThousandEyes Enterprise Agent
The 4 CVEs of Cisco ThousandEyes Enterprise Agent →
CVE-2026-20199
A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated,…
4.7
Medium
CVE-2026-20206
A vulnerability in the BrowserBot component of Cisco ThousandEyes Enterprise Agent could have allowed an…
6.3
Medium
CVE-2026-20161
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with…
5.5
Medium