// For flags

CVE-2024-20287

 

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit this vulnerability, the attacker must have valid administrative credentials for the device.

Una vulnerabilidad en la interfaz de administración basada en web de Cisco WAP371 Wireless-AC/N Dual Radio Access Point con Single Point Setup podría permitir que un atacante remoto autenticado realice ataques de inyección de comandos contra un dispositivo afectado. Esta vulnerabilidad se debe a una validación inadecuada de la entrada proporcionada por el usuario. Un atacante podría aprovechar esta vulnerabilidad enviando solicitudes HTTP manipuladas a la interfaz de administración basada en web de un sistema afectado. Una explotación exitosa podría permitir al atacante ejecutar comandos arbitrarios con privilegios de root en el dispositivo. Para aprovechar esta vulnerabilidad, el atacante debe tener credenciales administrativas válidas para el dispositivo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-11-08 CVE Reserved
  • 2024-01-17 CVE Published
  • 2024-08-01 CVE Updated
  • 2024-10-31 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Wap371 Firmware
Search vendor "Cisco" for product "Wap371 Firmware"
*-
Affected
in Cisco
Search vendor "Cisco"
 Wap371
Search vendor "Cisco" for product "Wap371"
--
Safe