Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NSummary
CVE-2023-20016 is a medium-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Cisco Ucs Central Software. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24195
Vulnerability Data
A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in the…
more
full state and configuration backup files. This vulnerability is due to a weakness in the encryption method used for the backup function. An attacker could exploit this vulnerability by leveraging a static key used for the backup configuration feature. A successful exploit could allow the attacker to decrypt sensitive information that is stored in full state and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and other credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 4 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Proper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries.
Supply chain protection includes scrutiny of cryptographic implementations, reducing hard-coded keys planted by untrusted vendors.
Functional and assurance requirements specified in acquisition can prohibit hard-coded cryptographic keys in delivered products.
Approved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates.
Assessments can uncover and prevent suppliers from shipping components that contain hard-coded cryptographic keys.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.
Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.
Data-in-transit protection similarly depends on non-hard-coded keys for encryption.
Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require use of approved, sufficiently random values for keys and nonces.
Security testing can detect weak randomness but does not prescribe the control itself.
Secure SDLC processes include verification steps that can catch insufficient randomness but do not directly specify RNG requirements.
Secure coding standards explicitly prohibit use of weak or predictable random number generators.
Secure authentication mechanisms depend on unpredictable values (nonces, salts, session tokens) to resist guessing.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-330
- V-248599 OL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
- V-248600 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
Oracle Linux 9 (1 rule)
- V-271511 OL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 8 (3 rules)
- V-244527 RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
- V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-330
- V-230285 RHEL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 9 (1 rule)
- V-257782 RHEL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330