CVE-2023-20012 — Improper Authentication in Cisco UCS Central Software

CWE-287 — Improper Authentication4 documents4 sources
Severity
4.6MEDIUMNVD
CNA5.3
EPSS
0.1%
top 72.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco UCS Central SoftwareCisco Unified Computing System
Timeline
PublishedFeb 23

Description

A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability is due to the improper implementation of the password validation function. An attacker could exploit this vulnerability by logging in to the console port on an affected device. A successful exploit could allow the attacker to bypass aut…

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/ucs_central_software4.2 — 4.2\(2d\)

🔴Vulnerability Details

2
CVEList
Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass Vulnerability↗2023-02-23
▶
GHSA
GHSA-w6qv-pc93-vvwj: A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect depl↗2023-02-23
▶

📋Vendor Advisories

1
Cisco
Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass Vulnerability↗2023-02-22
▶
CVE-2023-20012 — Improper Authentication in Cisco | cvebase