ZDI-26-719: Cisco ThousandEyes Virtual Appliance DHCP Client Command Injection Remote Code Execution Vulnerability
ZDI discloses an authenticated DHCP command-injection RCE in Cisco ThousandEyes, CVE-2026-20350, CVSS 7.2.
46
CVE-2026-20350
RCE in Cisco ThousandEyes Virtual Appliance Management Interface 2026-20350
- CVSS 3.1
- 4.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated, remote attacker to inject arbitrary operating system commands. The flaw stems from improper validation of user-supplied input, enabling attackers to save malicious configuration values and execute arbitrary OS commands with root privileges. This requires valid administrative credentials. The affected product is Cisco ThousandEyes Virtual Appliance, with no known public exploit or fixed versions currently in the data.
What to do: Upgrade to latest versions of Cisco ThousandEyes Virtual Appliance; enable network-level controls and input validation checks; monitor for unauthorized management access and configure robust authentication and access controls.
| Product | Affected |
|---|---|
| Cisco ThousandEyes Virtual Appliance | — |
Estimated exposure
≈unknown (no concrete counts available) — No concrete installation or system counts are provided; based on plugin active-install counts and market share, the affected scale is estimated as moderate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by saving configuration details that contain malicious values. A successful exploit could allow the attacker to execute arbitrary operating system commands with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials.
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L