CVE-2023-20121

cisco evolved programmable network manager, cisco identity services engine, cisco prime infrastructure

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-20121

Katalog CVE

CVSS 6.7 · Medium EPSS 0,20%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada cisco evolved programmable network manager, cisco identity services engine +1 lainnya. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.

Rincian

Terbit di NVD
5 April 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari)
0,20% peluang dieksploitasi; lebih tinggi dari 9,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco evolved programmable network manager Semua versi sebelum 7.0.1
cisco identity services engine Versi 3.2
cisco prime infrastructure Semua versi sebelum 3.10.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.