CVE-2023-20186 — Improper Authorization in Cisco IOS XE Software

CWE-285 — Improper Authorization5 documents5 sources
Severity
9.1CRITICALNVD
CNA8.0
EPSS
0.1%
top 70.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco IOS XE SoftwareCisco IOSCisco IOS XE
Timeline
PublishedSep 27

Description

A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy Protocol (SCP). This vulnerability is due to incorrect processing of SCP commands in AAA command authorization checks. An attacker with valid credentials and level 15 privileges could exploit this vulnerab…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages4 packages

▶CVEListV5cisco/cisco_ios_xe_software380 versions+379
▶CVEListV5cisco/ios614 versions+613
▶NVDcisco/ios615 versions+614
▶NVDcisco/ios_xe381 versions+380

🔴Vulnerability Details

2
CVEList
CVE-2023-20186: A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an auth↗2023-09-27
▶
GHSA
GHSA-2hj4-ccw5-92h5: A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an auth↗2023-09-27
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)↗2023-04-08
▶

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software Command Authorization Bypass Vulnerability↗2023-09-27
▶
CVE-2023-20186 — Improper Authorization in Cisco | cvebase