CVE-2024-20418

criticalPriorität · verfolgen · 1EPSS 0.031 · 88. PerzentilDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.13% (88th) EPSS

CVSS 10 · critical

Is it mine?

10 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated, remote attacker to perform command injection attacks with root privileges on the underlying operating system. This vulnerability is due to improper validation of input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco Aironet Access Point Software (IOS XE Controller)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · psirt@cisco.com USAusnutzbarkeit 3.9 · Auswirkung 6

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-77USCWE-77USCWE-77US

betroffene Produkte (10)

Betroffene Produkte und Versionsbereiche.

Cisco Catalyst Unified Industrial Wireless Software <17.15.1alle Versionencert_bundDE
Cisco Catalyst≤ Unified Industrial Wireless Software <17.15.1cert_bundDE
Cisco Cisco Aironet Access Point Software (IOS XE Controller)alle Versionencisco_csafUS
Cisco Cisco Aironet Access Point Software (IOS XE Controller)≤ N/Aenisa_euvdEU
Cisco Systems Inc. Catalyst IW9165D Heavy Duty Access Points≤ 17.15.1fstec_bduRU
Cisco Systems Inc. Catalyst IW9165E Rugged Access Points and Wireless Clients≤ 17.15.1fstec_bduRU
Cisco Systems Inc. Catalyst IW9167E Heavy Duty Access Points≤ 17.15.1fstec_bduRU
aironet_access_point_softwarealle Versionenncsc_nlNLcpe:2.3:a:cisco:aironet_access_point_software:0:*:*:*:*:*:*:*
aironet_access_point_softwarealle Versionenncsc_nlNLcpe:2.3:a:cisco:aironet_access_point_software:17.14:*:*:*:*:*:*:*
cisco_aironet_access_point_software__ios_xe_controller_alle Versionenncsc_nlNLcpe:2.3:a:cisco:cisco_aironet_access_point_software__ios_xe_controller_:n_a:*:*:*:*:*:*:*

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2024-0430Kwetsbaarheid verholpen in Cisco Catalyst Access pointsNL2024-11-07csaf · ncsc_nlNL
Cisco heeft een kwetsbaarheid verholpen in de Unified Industrial Wireless Software voor Catalyst Heavy Duty Access Points.
WID-SEC-W-2024-3352Cisco Catalyst Access Points: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2024-11-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Catalyst ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.
cisco-sa-backhaul-ap-cmdinj-R7E28EcsCisco Unified Industrial Wireless Software for Ultra-Reliable Wireless Backhaul Access Point Command Injection Vulnerability2024-11-06csaf · cisco_csafUS
A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated, remote attacker to perform command injection attacks with root privileges on the underlying operating system. This vulnerability is due to improper validation of input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf ncsc_nl NVD CVE.org MITRE

veröffentlicht 2024-11-06geändert 2026-06-17

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan