Cisco Secure Web Appliance up to 15.1.0-287 CLI unnecessary privileges

Summaryinfo

A vulnerability, which was classified as critical, has been found in Cisco Secure Web Appliance. Affected is an unknown function of the component CLI. The manipulation leads to unnecessary privileges. This vulnerability is listed as CVE-2024-20435. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Secure Web Appliance. It has been rated as critical. This issue affects an unknown functionality of the component CLI. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. Using CWE to declare the problem leads to CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this vulnerability by authenticating to the system and executing a crafted command on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least guest credentials.

The advisory is shared at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2024-20435 since 11/08/2023. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/08/2025). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Cisco

Name

• Secure Web Appliance

Version

• 11.7.0-406
• 11.7.0-418
• 11.7.1-006
• 11.7.1-020
• 11.7.1-049
• 11.7.2-011
• 11.8.0-414
• 11.8.1-023
• 11.8.3-018
• 11.8.3-021
• 12.0.1-268
• 12.0.3-007
• 12.5.1-011
• 12.5.2-007
• 12.5.4-005
• 12.5.5-004
• 12.5.6-008
• 14.0.2-012
• 14.0.3-014
• 14.0.4-005
• 14.0.5-007
• 14.5.0-498
• 14.5.1-016
• 14.5.2-011
• 15.0.0-322
• 15.0.0-355
• 15.1.0-287

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion