CVE-2023-20229

Summary

CVE-2023-20229 is a vulnerability impacting the CryptoService function of Cisco Duo Device Health Application for Windows. This issue allows authenticated, low-privilege attackers to carry out directory traversal attacks, potentially leading to overwriting of arbitrary files on affected systems. The root cause of this vulnerability is insufficient input validation, enabling attackers to execute manipulated directories and overwrite files with SYSTEM-level privileges. The exploitation of this flaw could result in a denial of service (DoS) condition or data loss.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.