PT-2022-6953 · Cisco · Cisco Ios Xr

Published 2022-10-27 · Updated 2024-01-25 · CVE-2023-20191

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing workarounds that address this vulnerability. Restrict access to the affected MPLS interfaces to minimize the risk of exploitation. Avoid using the affected ACL processing feature until the issue is resolved.

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-264

CWE-863

Related Identifiers

BDU:2023-05806

CVE-2023-20191

Affected Products

Cisco Ios Xr

References · 7

• https://osv.dev/vulnerability/CVE-2023-20191 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnx-acl-PyzDkeYF · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05806 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20191 · Security Note
• https://twitter.com/CVEnew/status/1702002497421009148 · Twitter Post
• https://t.me/cibsecurity/70403 · Telegram Post
• https://vuldb.com/ru/?id.239686 · Note