CVE-2024-20358— Cisco Firepower Threat Defense和Adaptive Security Appliance 操作系统命令注入漏洞

N/A

A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability exists because the contents of a backup file are improperly sanitized at restore time. An attacker could exploit this vulnerability by restoring a crafted backup file to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as root.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Cisco Firepower Threat Defense和Adaptive Security Appliance 操作系统命令注入漏洞

Cisco Firepower Threat Defense（FTD）和Cisco Adaptive Security Appliance都是美国思科（Cisco）公司的产品。Cisco Firepower Threat Defense是一套提供下一代防火墙服务的统一软件。Cisco Adaptive Security Appliance是一个网络设备。用于保护各种规模的公司网络和数据中心。 Cisco Adaptive Security Appliance (ASA) 、Cisco Firepower

N/A

N/A