CVE-2023-20209

Vulnerability

A command injection vulnerability exists in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS). The issue is due to insufficient validation of user-supplied input. Affected versions include those running vulnerable releases of Cisco Expressway Series and Cisco TelePresence VCS with the Automatic Certification Revocation Lists (CRL) updates feature enabled. This feature is disabled by default, but an attacker with read-write privileges can enable it. [1]

Exploitation

An attacker must have authenticated read-write privileges on the application. The Automatic CRL updates feature must be enabled (the attacker can enable it if they have the required privileges). The attacker then sends a crafted request to the web-based management interface, which triggers the command injection. [1]

Impact

Successful exploitation allows the attacker to establish a remote shell with root privileges, resulting in full compromise of the affected device, including the ability to execute arbitrary commands. [1]

Mitigation

Cisco has released software updates that address this vulnerability. No workarounds are available. Users should upgrade to a fixed version as specified in the Cisco Security Advisory. [1]