CVE-2024-20277

A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands and elevate privileges to root.

• CWE-78

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3QvIssue Tracking, Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3QvIssue Tracking, Vendor Advisory

Published

Jan 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-20271A vulnerability in the IP packet processing of Cisco Access …8.6
• CVE-2024-20272A vulnerability in the web-based management interface of Cis…9.8
• CVE-2024-20273A vulnerability in the web-based management interface of Cis…6.1
• CVE-2024-20274A vulnerability in the web-based management interface of Cis…5.5
• CVE-2024-20275A vulnerability in the cluster backup feature of Cisco Secur…6.1
• CVE-2024-20276A vulnerability in Cisco IOS Software for Cisco Catalyst 600…7.4
• CVE-2024-20278A vulnerability in the NETCONF feature of Cisco IOS XE Softw…6.5
• CVE-2024-20279A vulnerability in the restricted security domain implementa…4.3
• CVE-2024-2028The Exclusive Addons for Elementor plugin for WordPress is v…5.4
• CVE-2024-20280A vulnerability in the backup feature of Cisco UCS Central S…6.3
• CVE-2024-20281A vulnerability in the web-based management interface of Cis…8.8
• CVE-2024-20282A vulnerability in Cisco Nexus Dashboard could allow an auth…6