CVE-2024-20429

A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary system commands on an affected device. This vulnerability is due to insufficient input validation in certain portions of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To successfully exploit this vulnerability, an attacker would need at least valid Operator credentials.

• CWE-74

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-priv-esc-ssti-xNO2EOGZVendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-priv-esc-ssti-xNO2EOGZVendor Advisory

Published

Jul 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-20419A vulnerability in the authentication system of Cisco Smart …10
• CVE-2024-2042The ElementsKit Elementor addons plugin for WordPress is vul…5.4
• CVE-2024-20420A vulnerability in the web-based management interface of Cis…8.8
• CVE-2024-20421A vulnerability in the web-based management interface of Cis…6.5
• CVE-2024-20424A vulnerability in the web-based management interface of Cis…9.9
• CVE-2024-20426A vulnerability in the Internet Key Exchange version 2 (IKEv…8.6
• CVE-2024-2043The EleForms – All In One Form Integration including DB for …5.3
• CVE-2024-20430A vulnerability in Cisco Meraki Systems Manager (SM) Agent f…7.3
• CVE-2024-20431A vulnerability in the geolocation access control feature of…5.8
• CVE-2024-20432A vulnerability in the REST API and web UI of Cisco Nexus Da…8.8
• CVE-2024-20433A vulnerability in the Resource Reservation Protocol (RSVP) …7.5
• CVE-2024-20434A vulnerability in Cisco IOS XE Software could allow an unau…4.3