Kyle Ossinger

A flaw exists in certain command-line interface (CLI) commands within the software that could allow a local attacker with Administrator privileges to execute Lua code as root. This is due to insufficient input sanitization. An attacker could craft malicious Lua code and submit it as a parameter to a CLI command, potentially leading to arbitrary code execution with root privileges.

A flaw exists in the sftunnel functionality that may allow an authenticated, remote attacker with administrative privileges to write arbitrary files as root on the underlying operating system. This is caused by inadequate validation of the directory path during file synchronization. An attacker could exploit this by creating a directory path outside the expected file location, potentially enabling the creation or replacement of any file on the operating system.

A flaw exists in the Command Line Interface (CLI) of Cisco Secure FTD Software that could allow a local attacker with administrative privileges to execute arbitrary commands on the operating system with root access. This is caused by inadequate validation of user-provided command arguments. An attacker could exploit this by submitting specially crafted input to a specific CLI command. Successful exploitation could lead to the execution of commands with root privileges on the underlying operating system.

A flaw in the web-based management interface allows an authenticated remote attacker to perform SQL injection attacks. This issue stems from inadequate validation of user-supplied input. By sending crafted requests, an attacker with valid user credentials could gain full access to the database and read specific files on the underlying operating system.

A flaw exists in the SAML 2.0 single sign-on (SSO) feature that could allow a remote, unauthenticated attacker to cause the device to reload unexpectedly, leading to a denial-of-service (DoS) condition. This is due to insufficient error checking when processing SAML messages. An attacker could exploit this by sending crafted SAML messages to the SAML service.

A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device. This issue is due to improper access control on certain CLI commands. An attacker could exploit this vulnerability by running a series of crafted commands, potentially allowing them to elevate privileges to root.

The issue is related to insufficient validation of incoming requests, which could allow an attacker to conduct a Server-Side Request Forgery (SSRF) attack. This can be achieved by sending a specially crafted HTTP request. The vulnerability is due to improper validation of user-supplied input, allowing an authenticated, local attacker to bypass access controls.