CVE-2023-20236
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD
Description
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.
This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.
Affected (1)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 7.10.1 |
| Running on/with | Platform Versions |
|---|---|
Cisco 8201 | All versions |
Cisco 8202 | All versions |
Cisco 8208 | All versions |
Cisco 8212 | All versions |
Cisco 8218 | All versions |
Cisco 8804 | All versions |
Cisco 8808 | All versions |
Cisco 8812 | All versions |
Cisco 8818 | All versions |
Cisco 8831 | All versions |
Cisco Asr 9000 | All versions |
Cisco Asr 9000v | All versions |
Cisco Asr 9001 | All versions |
Cisco Asr 9006 | All versions |
Cisco Asr 9010 | All versions |
Cisco Asr 9901 | All versions |
Cisco Asr 9902 | All versions |
Cisco Asr 9903 | All versions |
Cisco Asr 9904 | All versions |
Cisco Asr 9906 | All versions |
Cisco Asr 9910 | All versions |
Cisco Asr 9912 | All versions |
Cisco Asr 9920 | All versions |
Cisco Asr 9922 | All versions |
Cisco Ncs 1001 | All versions |
Cisco Ncs 1002 | All versions |
Cisco Ncs 1004 | All versions |
Cisco Ncs 4009 | All versions |
Cisco Ncs 4016 | All versions |
Cisco Ncs 4201 | All versions |
Cisco Ncs 4202 | All versions |
Cisco Ncs 4206 | All versions |
Cisco Ncs 4216 | All versions |
Cisco Ncs 5001 | All versions |
Cisco Ncs 5002 | All versions |
Cisco Ncs 5011 | All versions |
Cisco Ncs 540 | All versions |
Cisco Ncs 5500 | All versions |
Cisco Ncs 5501 | All versions |
Cisco Ncs 5502 | All versions |
Cisco Ncs 5504 | All versions |
Cisco Ncs 5508 | All versions |
Cisco Ncs 5516 | All versions |
Cisco Ncs 560 | All versions |
Cisco Ncs 560 4 | All versions |
Cisco Ncs 560 7 | All versions |
Cisco Ncs 57b1 5dse Sys | All versions |
Cisco Ncs 57b1 6d24 Sys | All versions |
Cisco Ncs 57c1 48q6 Sys | All versions |
Cisco Ncs 57c3 Mod Sys | All versions |
Cisco Ncs 57c3 Mods Sys | All versions |
Related CWEs
CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-347
Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
References (2)
Source: psirt@cisco.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.