CVE-2023-20046highCWE-289

CVE-2023-20046: high-severity vulnerability in Cisco ASR 5000 Series Software

Published · Updated

Follow this CVE+ Monitor Cisco ASR 5000 Series+ Monitor Cisco Ultra Cloud Core - User Plane Function

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.6%
A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user. There are workarounds that address this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco ASR 5000 Series SoftwareCisco · Cisco Ultra Cloud Core - User Plane Function
Related CVEs — Cisco ASR 5000 Series Software

In the same product, most dangerous first.

CVE-2019-1869HIGHCisco StarOS Denial of Service VulnerabilityEPSS 2.6%CVE-2020-3500MEDIUMCisco StarOS IPv6 Denial of Service VulnerabilityEPSS 1.6%CVE-2021-1378MEDIUMCisco StarOS Denial of Service VulnerabilityEPSS 1.5%CVE-2019-16026MEDIUMCisco Mobility Management Entity Denial of Service VulnerabilityEPSS 1.4%CVE-2021-1353MEDIUMCisco StarOS IPv4 Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1145MEDIUMCisco StarOS for Cisco ASR 5000 Series Routers Arbitrary File Read VulnerabilityEPSS 1.3%