CVE-2023-20044
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.1%
exploitation probability
0.1%top 96% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in Cisco CX Cloud Agent allows a logged-in user to gain full control of the device by exploiting insecure file permissions. An attacker tricks support into updating settings that run a vulnerable script.
Technical detail
CWE-708 insecure file permissions in Cisco CX Cloud Agent enables local privilege escalation when an authenticated attacker persuades support personnel to update configuration settings that execute an improperly protected script, resulting in complete device compromise.
Summary generated and translated by AI from the official description.
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges.
This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by persuading support to update settings which call the insecure script. A successful exploit could allow the attacker to take complete control of the affected device.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco CX Cloud Agent