Cisco IND Command Injection & File Permissions Vulnerabilities (CVE-2023-20036/20039)

From this webpage screenshot, the following key information about the vulnerabilities can be obtained: 1. Vulnerability Type: - CVE-2023-20036: Cisco Industrial Network Director Command Injection Vulnerability - CVE-2023-20039: Cisco Industrial Network Director File Permissions Vulnerability 2. Affected Product: - Cisco Industrial Network Director (IND) 3. Vulnerability Description: - CVE-2023-20036: Due to improper input validation during device package upload, remote attackers can execute arbitrary commands with administrative privileges. - CVE-2023-20039: Due to insufficient default file permissions, attackers can read application data by accessing files in the application data directory. 4. Vulnerability Impact: - CVE-2023-20036: Allows execution of arbitrary commands, potentially enabling attackers to run commands with NT AUTHORITY\SYSTEM privileges. - CVE-2023-20039: Enables reading of application data, potentially allowing attackers to access sensitive information. 5. Mitigation Measures: - Cisco has released software updates to fix these vulnerabilities. - No workarounds are available. 6. Affected Software Versions: - No affected software versions listed. 7. Rating: - CVE-2023-20036: Approved - CVE-2023-20039: Approved 8. Related Links: - Security Vulnerability Details: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V This information helps users understand the nature of the vulnerabilities, their impact, and how to remediate them through software updates.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IND Command Injection & File Permissions Vulnerabilities (CVE-2023-20036/20039)