medium6.0
CVE-2023-20210
A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device.
Impact
A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device. The vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing a crafted command to the affected system. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, an attacker must have valid BroadWorks administrative privileges on the affected device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Broadworks Application Delivery Platform Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Application Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Database Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Database Troubleshooting Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Execution Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Media Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Messaging Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Network Database Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Network Function Manager Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Network Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Profile Server Firmware | Versions 23.0, 24.0, 25.0 |
| Cisco | Broadworks Service Control Function Server Firmware | Versions 23.0, 24.0, 25.0 |