CVE-2024-20306
Last modified
CVE-2024-20306 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | 17.10.1 |
| Cisco | Ios Xe | 17.10.1a |
| Cisco | Ios Xe | 17.10.1b |
| Cisco | Ios Xe | 17.11.1 |
| Cisco | Ios Xe | 17.11.1a |
| Cisco | Ios Xe | 17.11.99sw |
| Cisco | Ios Xe | 17.12.1 |
| Cisco | Ios Xe | 17.12.1a |
| Cisco | Ios Xe | 17.12.1w |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-20306?
How severe is CVE-2024-20306?
How do I fix CVE-2024-20306?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-20300A vulnerability in the web-based management interface of Cis…5.4
- CVE-2024-20301A vulnerability in Cisco Duo Authentication for Windows Logo…6.2
- CVE-2024-20302A vulnerability in the tenant security implementation of Cis…4.3
- CVE-2024-20303A vulnerability in the multicast DNS (mDNS) gateway feature …7.4
- CVE-2024-20304A vulnerability in the multicast traceroute version 2 (Mtrac…7.5
- CVE-2024-20305A vulnerability in the web-based management interface of Cis…4.8
- CVE-2024-20307A vulnerability in the IKEv1 fragmentation code of Cisco IOS…7.5
- CVE-2024-20308A vulnerability in the IKEv1 fragmentation code of Cisco IOS…7.5
- CVE-2024-20309A vulnerability in auxiliary asynchronous port (AUX) functio…5.5
- CVE-2024-2031The Video Conferencing with Zoom plugin for WordPress is vul…5.4
- CVE-2024-20310A vulnerability in the web-based interface of Cisco Unified …6.1
- CVE-2024-20311A vulnerability in the Locator ID Separation Protocol (LISP)…7.5
Are you affected by CVE-2024-20306?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST