CVE-2023-20097: Cisco Access Point Software Command Injection Vulnerability
A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-20097?
CVE-2023-20097 is a vulnerability in Cisco access points (AP) software that allows an authenticated local attacker to inject and execute arbitrary commands with root privileges.
How does CVE-2023-20097 affect Cisco wireless LAN controller software?
Cisco wireless LAN controller software versions up to 8.10.183.0 are affected by CVE-2023-20097.
Which Cisco Aironet Access Point Software versions are affected by CVE-2023-20097?
Cisco Aironet Access Point Software versions up to 17.9.0.135 are affected by CVE-2023-20097.
What is the severity of CVE-2023-20097?
CVE-2023-20097 has a severity rating of 6.7 (medium).
Where can I find more information about CVE-2023-20097?
More information about CVE-2023-20097 can be found at the Cisco Security Advisory at the following link: [Cisco Security Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8).