Permissions, Privileges, and Access Controls in Cisco IOS XE - CVE-2023-20065
Published: March 23, 2023
Vulnerability identifier: #VU73989
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20065
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient restrictions on the hosted application, which leads to security restrictions bypass and privilege escalation.
Affected software
Cisco IOS XE
How to mitigate CVE-2023-20065
Install updates from vendor's website.
Cisco IOS XE - addressed in versions Dublin-17.10.1, Dublin-17.10.1a, Cupertino-17.9.3, 17.3(6.28), 17.9(2.2), 17.9.3, 17.10(0.40), 17.10.1, 17.10.1a, 17.11(0.23)