PT-2022-6955 · Cisco · Cisco Ios Xr

Published 2022-10-27 · Updated 2024-01-25 · CVE-2023-20190

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description A vulnerability in the classic access control list (ACL) compression feature could allow an unauthenticated, remote attacker to bypass the protection offered by a configured ACL on an affected device. This is due to incorrect destination address range encoding in the compression module of an ACL applied to an interface of an affected device. An attacker could exploit this by sending traffic through the affected device that should be denied by the configured ACL, potentially allowing access to trusted networks.

Recommendations There are workarounds that address this vulnerability. Cisco has released software updates that address this vulnerability. As a temporary workaround, consider disabling the ACL compression feature until a patch is available. Restrict access to the affected device to minimize the risk of exploitation. Avoid using the affected ACL configurations until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

CWE-264

Related Identifiers

BDU:2023-05814

CVE-2023-20190

Affected Products

Cisco Ios Xr

References · 7

• 🔥 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-comp3acl-vGmp6BQ3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-20190 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05814 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20190 · Security Note
• https://t.me/cibsecurity/70406 · Telegram Post
• https://vuldb.com/ru/?id.239687 · Note
• https://twitter.com/CVEnew/status/1702002496259211616 · Twitter Post