CVE-2023-20262

CWE-399CWE-286CWE-798 — Hard-coded CredentialsCWE-862 — Missing Authorization4 documents4 sources
Severity
7.5HIGH
EPSS
0.3%
top 44.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco Catalyst Sd-wan ManagerCisco Sd-wan VmanageCisco Cisco Sd-wan Solution+2 more
Timeline
PublishedSep 27

Description

A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH access only. This vulnerability does not prevent the system from continuing to function, and web UI access is not affected. This vulnerability is due to insufficient resource management when an affected system is in an error condition. An attacker could exploit this vulnerability by sending malicious traffic to the affe…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶NVDcisco/catalyst_sd-wan_manager20.4 — 20.9.3
▶NVDcisco/sd-wan_vmanage20.10 — 20.11.1+2
▶CVEListV5cisco/cisco_sd-wan_vmanage75 versions+74
▶CVEListV5cisco/cisco_sd-wan_solution91 versions+90

🔴Vulnerability Details

2
CVEList
CVE-2023-20262: A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resultin↗2023-09-27
▶
GHSA
GHSA-h2rg-8hq7-x2qc: A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resultin↗2023-09-27
▶

📋Vendor Advisories

1
Cisco
Cisco Catalyst SD-WAN Manager Vulnerabilities↗2023-09-27
▶
CVE-2023-20262 (HIGH CVSS 7.5) | A vulnerability in the SSH service | cvebase.io