Input validation error in Cisco Systems, Inc products - CVE-2023-20168

Vulnerability identifier: #VU79968

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20168

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in TACACS+ and RADIUS. A local attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Cisco Nexus 9000 Series Switches NX-OS Mode
Nexus 7000 Series Switches
Nexus 6000 Series Switches
Nexus 5600 Platform Switches
Nexus 5500 Platform Switches
Cisco Nexus 3000 Series Switches
Nexus 1000V Switch for VMware vSphere
Nexus 1000V Switch for Microsoft Hyper-V
Cisco MDS 9000 Series Multilayer Switches
Nexus 1000 Virtual Edge for VMware vSphere
Cisco NX-OS

Install updates from vendor's website.

Cisco NX-OS - addressed in versions 7.3(14)N1(1), 8.2(10), 8.4(8), 9.3(2a), 9.3(12), 9.4(1), 10.2(3v), 10.3(3), 10.3(99w)

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-remoteauth-dos-XB6pv74m

• Denial of service in Cisco NX-OS Software