Cisco Secure Web Appliance Privilege Escalation Vulnerability

A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Cisco AsyncOS 操作系统命令注入漏洞

Cisco AsyncOS是美国思科（Cisco）公司的一款应用于思科设备的操作系统。 Cisco AsyncOS for Cisco Secure Web Appliance（Cisco Web Security Appliance ，WSA）存在操作系统命令注入漏洞，该漏洞源于对用户提供的web界面输入验证不足。远程攻击者利用该漏洞执行命令注入并提升权限。

N/A

N/A