CVE-2023-20029
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
23/03/2023
Last modified:
07/11/2023
Description
A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Meraki onboarding feature of an affected device. An attacker could exploit this vulnerability by modifying the Meraki registration parameters. A successful exploit could allow the attacker to elevate privileges to root.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:* | ||
cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:* | ||
cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page