CVE-2023-20039: 
Cisco Industrial Network Director vulnerability analysis and mitigation

A vulnerability in Cisco Industrial Network Director (IND) could allow an authenticated, local attacker to read application data. The vulnerability (CVE-2023-20039) has a CVSS base score of 5.5 (Medium) and affects Cisco IND versions earlier than 1.11.3. The vulnerability is due to insufficient default file permissions that are applied to the application data directory (Cisco Advisory).

The vulnerability (CVE-2023-20039) stems from insufficient default file permissions applied to the application data directory. It has a CVSS Vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating local access, low attack complexity, low privileges required, no user interaction needed, unchanged scope, no impact on confidentiality, high impact on integrity, and no impact on availability (Cisco Advisory).

A successful exploitation of this vulnerability could allow an authenticated attacker to view sensitive information by accessing files in the application data directory (Cisco Advisory, TheSecMaster).

There are no workarounds that address this vulnerability. Cisco has released software updates that address this vulnerability in version 1.11.3. Customers are advised to upgrade to the fixed version (Cisco Advisory, TheSecMaster).