PT-2023-5641 · Cisco · Cisco Ios Xe

Published 2023-09-27 · Updated 2024-01-25 · CVE-2023-20226

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in Application Quality of Experience (AppQoE) and Unified Threat Defense (UTD) on Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to the mishandling of a crafted packet stream through the AppQoE or UTD application. An attacker could exploit this vulnerability by sending a crafted packet stream through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Weakness Enumeration

CWE-456

CWE-404

Related Identifiers

BDU:2023-06301

CVE-2023-20226

Affected Products

Cisco Ios Xe

References · 8

• https://osv.dev/vulnerability/CVE-2023-20226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20226 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appqoe-utd-dos-p8O57p5y · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06301 · Security Note
• https://vuldb.com/?id.240712 · Note
• https://twitter.com/CVEnew/status/1707107041389797478 · Twitter Post
• https://t.me/cibsecurity/71134 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1707139129840922770 · Twitter Post