CVE-2023-20115
Cisco Nx-Os 10.1\(1\) … 9.3\(9\)
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2023-20115 is a medium-severity Lack of Administrator Control over Security (CWE-671) vulnerability in Cisco Nx-Os. Its CVSS base score is 5.4 (Medium).
Operationally, ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24294
Vulnerability Data
A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attacker to download or overwrite files from the underlying operating system of an affected…
more
device. This vulnerability is due to a logic error when verifying the user role when an SFTP connection is opened to an affected device. An attacker could exploit this vulnerability by connecting and authenticating via SFTP as a valid, non-administrator user. A successful exploit could allow the attacker to read or overwrite files from the underlying operating system with the privileges of the authenticated user. There are workarounds that address this vulnerability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.2.11V13.2.3V4.3.2V8.1.4
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Configuration management directly enables administrators to tailor security settings and baselines to their environment.
Establishing admin roles and authorities supports the ability to exercise security control but does not address product-level restrictions.
Defining and enforcing access policies gives administrators explicit control over authorization settings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policy defines how administrators can tailor security settings to the environment.
Access rights management enables administrators to adjust privileges and security parameters as needed.
Privileged access rights control ensures administrators can configure and restrict elevated security functions.
Information access restriction mechanisms allow administrators to set and modify access rules for the environment.
Configuration management provides the means for administrators to tailor security settings and harden the product.