CVE-2023-33376

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

Published: Aug 4, 2023 / Updated: 15mo ago

MISC cisco — cisco_sd-wan_vmanage A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

MISC cisco — cisco_sd-wan_vmanage A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

MISC cisco — cisco_sd-wan_vmanage A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVE-2023-33376 (CVSS score: 8.6) – An argument injection vulnerability in its ip tables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices. CVE-2023-33378 (CVSS score: 8.6) – An argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.

If exploited, an attacker could gain complete control over the cloud infrastructure, remotely execute malicious code, and expose sensitive user and device data. A series of critical vulnerabilities has been uncovered in ConnectedIO's ER2000 edge routers, which pose significant threats to cloud infrastructure security.

This meticulous scrutiny of ConnectedIO’s hardware revealed that these vulnerabilities could be potentially exploited by adversaries to gain unauthorized access and exert control over the networks and devices tethered to these routers. Description: This security flaw allows attackers to execute arbitrary commands on all devices connected to the vulnerable router without necessitating additional authentication protocols, thereby jeopardizing the security integrity of devices and data alike.

· CVE-2023-33376 (CVSS score: 8.6) – An argument injection vulnerability in the ip tables command message in the communication protocol, enabling attackers to execute arbitrary OS commands on devices. · CVE-2023-33378 (CVSS score: 8.6) – An argument injection vulnerability in the AT command message in the communication protocol, enabling attackers to execute arbitrary OS commands on devices.

Critical issues in ConnectedIO’s ER2000 edge routers have been discovered, and an attacker can leverage them to compromise the cloud infrastructure completely, remotely execute malicious code, and expose all user and device data. Researchers have discovered four new vulnerabilities that allow attackers to execute remote code on all connected devices.