#VU80773 Improper Verification of Cryptographic Signature in Cisco Systems, Inc products - CVE-2023-20236

Vulnerability identifier: #VU80773

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-20236

CWE-ID: CWE-347

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
Cisco IOS XR
Cisco 8000 Series Routers
Cisco ASR 9000 Series Aggregation Services Routers
NCS 4000
NCS 5000
NCS 5700 Series Routers
Cisco Network Convergence System 1000 Series
NCS540
NCS5500
NCS560

Software vendor:
Cisco Systems, Inc

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to insufficient image verification in the iPXE boot function. A local administrator can boot an unverified software image on the target device.

Install updates from vendor's website.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB