SB2023051781 - Multiple vulnerabilities in Cisco Small Business Series Switches

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023051781

SB2023051781 - Multiple vulnerabilities in Cisco Small Business Series Switches

Published: May 17, 2023

Security Bulletin ID SB2023051781
Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 44% Medium 56%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2023-20024)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing requests sent to the web interface. A remote non-authenticated attacker can send a specially crafted request to the web interface, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.


2) Heap-based buffer overflow (CVE-ID: CVE-2023-20156)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing requests sent to the web interface. A remote non-authenticated attacker can send a specially crafted request to the web interface, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.


3) Heap-based buffer overflow (CVE-ID: CVE-2023-20157)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing requests sent to the web interface. A remote non-authenticated attacker can send a specially crafted request to the web interface, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.


4) Input validation error (CVE-ID: CVE-2023-20158)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted input to the web interface and perform a denial of service (DoS) attack.


5) Stack-based buffer overflow (CVE-ID: CVE-2023-20159)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling requests. A remote unauthenticated attacker can send specially crafted input to the web interface, trigger a stack-based buffer overflow and execute arbitrary code with root privileges on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


6) Buffer overflow (CVE-ID: CVE-2023-20160)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling requests. A remote unauthenticated attacker can send specially crafted input to the web interface, trigger a based buffer overflow and execute arbitrary code with root privileges on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


7) Stack-based buffer overflow (CVE-ID: CVE-2023-20161)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling requests. A remote unauthenticated attacker can send specially crafted input to the web interface, trigger a stack-based buffer overflow and execute arbitrary code with root privileges on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Information disclosure (CVE-ID: CVE-2023-20162)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the web interface. A remote attacker can read system configuration.


9) Stack-based buffer overflow (CVE-ID: CVE-2023-20189)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling requests. A remote unauthenticated attacker can send specially crafted input to the web interface, trigger a stack-based buffer overflow and execute arbitrary code with root privileges on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References