PT-2023-1436 · Cisco · Cisco Nexus Dashboard

Published 2023-02-15 · Updated 2024-01-25 · CVE-2023-20014

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard Software (affected versions not specified)

Description A vulnerability in the DNS functionality could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This issue is due to the improper processing of DNS requests. An attacker could exploit this by sending a continuous stream of DNS requests to an affected device, potentially causing the coredns service to stop working or the device to reload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

CWE-399

Related Identifiers

BDU:2023-00843

CVE-2023-20014

Affected Products

Cisco Nexus Dashboard

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-dnsdos-bYscZOsu · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00843 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20014 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20014 · Vendor Advisory
• https://t.me/cvenotify/45957 · Telegram Post
• https://t.me/true_secator/4084 · Telegram Post