PT-2023-2503 · Cisco · Cisco Ios Xe

X. B · Published 2023-03-22 · Updated 2023-04-05 · CVE-2023-20029

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Meraki onboarding feature of an affected device. An attacker could exploit this vulnerability by modifying the Meraki registration parameters. A successful exploit could allow the attacker to elevate privileges to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2023-02297

CVE-2023-20029

Affected Products

Cisco Ios Xe

References · 5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20029 · Security Note
• https://bdu.fstec.ru/vul/2023-02297 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20029 · Vendor Advisory
• https://t.me/cvenotify/46721 · Telegram Post