CVE-2024-20265

CWE-5014 documents4 sources
Severity
5.9MEDIUM
EPSS
0.0%
top 96.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cisco Cisco Aironet Access Point SoftwareCisco Cisco Aironet Access Point Software (ios XE Controller)Cisco Cisco Business Wireless Access Point Software+1 more
Timeline
PublishedMar 27

Description

A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot functionality and load a software image that has been tampered with on an affected device. This vulnerability exists because unnecessary commands are available during boot time at the physical console. An attacker could exploit this vulnerability by interrupting the boot process and executing specific commands to bypass the Cisco Secure Boot va…

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 0.7 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5cisco/cisco_aironet_access_point_software103 versions+102

🔴Vulnerability Details

2
GHSA
GHSA-gqw2-gvrw-vqqg: A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure B↗2024-03-27
▶
CVEList
CVE-2024-20265: A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure B↗2024-03-27
▶

📋Vendor Advisories

1
Cisco
Cisco Access Point Software Secure Boot Bypass Vulnerability↗2024-03-27
▶
CVE-2024-20265 (MEDIUM CVSS 5.9) | A vulnerability in the boot process | cvebase.io