Main Vulnerability Database Vulnerabilities #VU80767

Improper access control in Cisco Systems, Inc products - CVE-2023-20191

Published: September 14, 2023

Vulnerability identifier: #VU80767

CSH Severity: High

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20191

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incomplete support in the access control list (ACL) processing on MPLS interfaces in the ingress direction. A remote attacker can bypass an ACL on the affected device.

Affected software

IOS XR White box
Cisco Network Convergence System 540 Series Routers
NCS 5700 Series Routers
NCS560
NCS5500
Cisco IOS XR

How to mitigate CVE-2023-20191

Install updates from vendor's website.

Cisco IOS XR - addressed in versions 7.7.21, 7.9.2, 7.10.1

External References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnx-acl-PyzDkeYF

Related Security Bulletins