Improper Authentication in Cisco Systems, Inc products - CVE-2023-20003

Vulnerability identifier: #VU76284

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20003

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to a logic error with the social login implementation. A remote attacker on the local network can access the Guest Portal without authentication.

Business 140AC Access Point
Business 141ACM Mesh Extender
Business 142ACM Mesh Extender
Business 143ACM Mesh Extender
Business 151AXM Mesh Extender
Business 145AC Access Point
Business 240AC Access Point
Business 150AX Access Point

Install updates from vendor's website.

Business 140AC Access Point - update to 10.8.1.0
Business 141ACM Mesh Extender - update to 10.8.1.0
Business 142ACM Mesh Extender - update to 10.8.1.0
Business 143ACM Mesh Extender - update to 10.8.1.0
Business 151AXM Mesh Extender - update to 10.4.2.0
Business 145AC Access Point - update to 10.8.1.0
Business 240AC Access Point - update to 10.8.1.0
Business 150AX Access Point - update to 10.4.2.0

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbw-auth-bypass-ggnAfdZ

• Improper Authentication in Cisco Business Wireless Access Points