{"id":"CVE-2023-20097","title":"Cisco Access Points (AP)  Command Injection Vulnerability","summary":"A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges.\r\n\r\nThis vulnerability is due to improper input validation of commands tha…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","cvssSource":"vendor","vendor":"Cisco","product":"Cisco Aironet Access Point Software (IOS XE Controller)","affected":["aironet_access_point_software_ios_xe_controller","aironet_access_point_software"],"published":"2023-03-22","updated":"2023-03-22","sourceUpdated":"2023-03-22T16:00:00+00:00","source":"CSAF","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8"},{"url":"https://software.cisco.com"}],"tags":["csaf","vendor-advisory","cisco"],"epss":0.00236,"epssPercentile":0.14839,"ingestedAt":"2026-09-08T15:58:18.538Z","slug":"CVE-2023-20097","body":"## Overview\n\nA vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges.\r\n\r\nThis vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n## Vendor advisories\n\n- **cisco-sa-aironetap-cmdinj-6bjT4FL8** · Cisco · affected: Cisco Aironet Access Point Software (IOS XE Controller), Cisco Aironet Access Point Software · updated 2023-03-22 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8)\n\n**Cisco Access Point Software Command Injection Vulnerability**. Released 2023-03-22.\n\nAffected:\n\n- Cisco Aironet Access Point Software (IOS XE Controller)\n- Cisco Aironet Access Point Software\n\n## Remediation\n\nCisco has released software updates that address this vulnerability. https://software.cisco.com","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}