Information disclosure in Cisco Systems, Inc products - CVE-2023-20064

Vulnerability identifier: #VU73202

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-20064

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Cisco Systems, Inc

Affected software:
Cisco ASR 9000 Series Aggregation Services Routers
Cisco IOS XRv 9000 Router
Cisco Network Convergence System 540 Series Routers
NCS 1001 Series Routers
NCS 1002 Series Routers
NCS5000
NCS 5000 Series Routers
NCS 5700 Series Routers
NCS 6000 Series Routers
IOS XR White box
NCS560
NCS5500
Cisco IOS XR

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the inclusion of unnecessary commands within the GRand Unified Bootloader (GRUB). An attacker with physical access can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-load-infodisc-9rdOr5Fq