CVE-2023-20036

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITY\SYSTEM on the underlying operating system of an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-200375.4A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XCVE-2023-200388.8A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a CVE-2023-200395.5A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data. This vulnerability is due to insufficCVE-2023-200405.5A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause aCVE-2023-200416.1Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiCVE-2023-200428.6A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTCVE-2023-200436.7A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability iCVE-2023-200447.3A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability iCVE-2023-200457.2A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticateCVE-2023-200468.8A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevatCVE-2023-200476.5A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an uCVE-2023-200489.9A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attac
CVE-2023-20036: Critical severity, CVSS 9.9 | Vulnix