Cyber Resilience

CVE-2023-20097

Medium

Published: 23 March 2023

Published
23 March 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0021 42.9th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-20097 is a medium-severity Command Injection (CWE-77) vulnerability in Cisco Ios Xe. Its CVSS base score is 4.6 (Medium).

Operationally, ranked at the 42.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless…

more

controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

cisco
wireless lan controller software
≤ 8.10.183.0
cisco
aironet access point software
≤ 17.9.0.135
cisco
ios xe
≤ 16.12.8 · 17.1 — 17.3.6 · 17.4 — 17.6.5

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References