Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.0
CVE-2023-20098: A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory tr...
CVE-2023-20098 · published 3 years ago
Summary
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.
This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could ex...
What to do
- Update cisco sd-wan_vmanage to version 20.9.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | catalyst_sd-wan_manager |
20.11 cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.11:*:*:*:*:*:*:* |
| cisco | sd-wan_vmanage |
< 20.9.1 cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:* |
Original advisory text
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.
This vulnerability is due to improper filtering of directory tr...
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.
This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.
This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-24Path Traversal: '../filedir'
CWE-22Path Traversal
Timeline
Published9 May 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-20098 · NVD
Track software like this
Free during beta