PT-2022-6954 · Cisco · Cisco Ios Xr

Published 2022-10-27 · Updated 2024-01-25 · CVE-2023-20236

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XR (affected versions not specified)

Description The issue is related to insufficient image verification in the iPXE boot function of Cisco IOS XR software. This could allow an authenticated, local attacker to install an unverified software image on an affected device by manipulating the boot parameters for image verification during the iPXE boot process. A successful exploit could allow the attacker to boot an unverified software image on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

BDU:2023-05807

CVE-2023-20236

Affected Products

Cisco Ios Xr

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20236 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20236 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05807 · Security Note
• https://twitter.com/CVEnew/status/1702002499685920798 · Twitter Post
• https://t.me/cibsecurity/70404 · Telegram Post
• https://vuldb.com/ru/?id.239691 · Note