Improper Verification of Cryptographic Signature in Cisco Systems, Inc products - CVE-2023-20236

Vulnerability identifier: #VU80773

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20236

CWE-ID: CWE-347

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to insufficient image verification in the iPXE boot function. A local administrator can boot an unverified software image on the target device.

Cisco IOS XR
Cisco 8000 Series Routers
Cisco ASR 9000 Series Aggregation Services Routers
NCS 4000
NCS 5000
NCS 5700 Series Routers
Cisco Network Convergence System 1000 Series
NCS540
NCS5500
NCS560

Install updates from vendor's website.

Cisco IOS XR - update to 7.10.1

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB

• Improper Verification of Cryptographic Signature in Cisco IOS XR Software