CVE-2023-20260
First published: Wed Jan 17 2024(Updated: )
A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Evolved Programmable Network Manager | <7.1.1 | |
| Cisco Prime Infrastructure | <3.10.4 | |
| Cisco Prime Infrastructure | =3.10.4 | |
| Cisco Prime Infrastructure | =3.10.4-update_1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-20260?
CVE-2023-20260 is classified as a high-severity vulnerability due to its potential to allow unauthorized privilege escalation.
How do I fix CVE-2023-20260?
To mitigate CVE-2023-20260, upgrade Cisco Prime Infrastructure to version 3.10.4-update_1 or later and Cisco Evolved Programmable Network Manager to version 7.1.1 or later.
What are the affected versions of software for CVE-2023-20260?
CVE-2023-20260 affects Cisco Prime Infrastructure versions up to 3.10.4 and Cisco Evolved Programmable Network Manager versions up to 7.1.1.
Who can exploit CVE-2023-20260?
CVE-2023-20260 can be exploited by an authenticated, local attacker with access to the command line interface.
What kind of attack does CVE-2023-20260 involve?
CVE-2023-20260 involves an attack that takes advantage of improper processing of command line arguments, potentially leading to escalated privileges.
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cisco
- canonical/cisco evolved programmable network manager
- canonical/cisco prime infrastructure
- version/cisco prime infrastructure/3.10.4
- version/cisco prime infrastructure/3.10.4-update_1