Resource exhaustion in Cisco Systems, Inc products - CVE-2023-20268
Published: September 28, 2023
Vulnerability identifier: #VU81259
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20268
CWE-ID: CWE-400
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper control over consumption of internal resources when handling certain types of traffic. A remote attacker on the local network can send specially crafted traffic to the device, trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
Wireless LAN Controller Software
Cisco Business 150 Series AP Software
Catalyst 9800 Wireless Controller Software
Cisco Business 150 Series AP Software
Catalyst 9800 Wireless Controller Software
How to mitigate CVE-2023-20268
Install updates from vendor's website.
Wireless LAN Controller Software - update to 8.10.190.0
Cisco Business 150 Series AP Software - update to 10.6.2.0
Catalyst 9800 Wireless Controller Software - addressed in versions 17.3.8, 17.6.6, 17.9.4
Cisco Business 150 Series AP Software - update to 10.6.2.0
Catalyst 9800 Wireless Controller Software - addressed in versions 17.3.8, 17.6.6, 17.9.4