CVE-2023-20253
published 2023-09-27CVE-2023-20253: A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass…
PriorityP428medium5.5CVSS 3.1
AVLACLPRLUINSUCNIHAN
EPSS
0.17%
6.7th percentile
A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device.
This vulnerability is due to improper access control in the cli-management interface of an affected system. An attacker with low-privilege (read only) access to the cli could exploit this vulnerability by sending a request to roll back the configuration on for other controller and devices managed by an affected system. A successful exploit could allow the attacker to to roll back the configuration on for other controller and devices managed by an affected system.
Affected
78 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p5q8-553c-rh75: A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypas
ghsa_unreviewed·2023-09-27
CVE-2023-20253 [MEDIUM] CWE-286 GHSA-p5q8-553c-rh75: A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypas
A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device.
This vulnerability is due to improper access control in the cli-management interface of an affected system. An attacker with low-privilege (read only) access to the cli could exploit this vulnerability by sending a request to roll back the configuration on for other controller and devices managed by an affected system. A successful exploit could allow the attacker to to roll back the configuration on for other controller and devices managed by an affected system.
Cisco
Cisco Catalyst SD-WAN Manager Vulnerabilities
vendor_cisco·2023-09-27·CVSS 9.8
CVE-2023-20034 [CRITICAL] CWE-286 Cisco Catalyst SD-WAN Manager Vulnerabilities
Cisco Catalyst SD-WAN Manager Vulnerabilities
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service (DoS) condition on an affected system.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z
Cisco
Cisco Catalyst SD-WAN Manager Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2023-20253 Cisco Catalyst SD-WAN Manager Vulnerabilities
CVE-2023-20253: Cisco Catalyst SD-WAN Manager Vulnerabilities
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service (DoS) condition on an affected system. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-286, CWE-399, CWE-798, CWE-286, CWE-399, CWE-798, CWE-862, CWE-286, CWE-399, CWE-798, CWE-286, CWE-399, CWE-798, CWE-862
Bug IDs: CSCvw59643, CSCvz62234, CSCwd46383, CSCvw59643, CSCvz62234
No detection rules found.
No public exploits indexed.
2023-09-27
Published