PT-2022-6956 · Cisco · Cisco Ios Xr

Logan Sanderson · Published 2022-10-27 · Updated 2024-01-25 · CVE-2023-20233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description The issue is related to the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software. It is caused by incorrect processing of invalid continuity check messages (CCMs), which could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. An attacker could exploit this by sending crafted CCMs to an affected device, potentially causing the CFM service to crash when a user displays information about maintenance end points (MEPs) for peer MEPs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-354

Related Identifiers

BDU:2023-05816

CVE-2023-20233

Affected Products

Cisco Ios Xr

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-20233 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xr-cfm-3pWN8MKt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20233 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05816 · Security Note
• https://t.me/cibsecurity/70411 · Telegram Post
• https://vuldb.com/ru/?id.239690 · Note
• https://twitter.com/CVEnew/status/1702002498540847545 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023091419 · Note