6.8
Medium
CVE-2024-20277 A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance…
Description
A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands and elevate privileges to root.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco ThousandEyes Recorder Application | Versions not published |
References
- cisco-sa-thouseyes-privesc-DmzHG3Qv sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco ThousandEyes Recorder Application
The 4 CVEs of Cisco ThousandEyes Recorder Application →
CVE-2023-20224
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an…
7.8
High
CVE-2023-20217
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an…
5.5
Medium
CVE-2021-1537
A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local…
6.2
Medium