CVE-2023-20253
Cisco Catalyst Sd-Wan Manager 20.11 … 20.9
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HSummary
CVE-2023-20253 is a high-severity Incorrect User Management (CWE-286) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24432
Vulnerability Data
A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device. This…
more
vulnerability is due to improper access control in the cli-management interface of an affected system. An attacker with low-privilege (read only) access to the cli could exploit this vulnerability by sending a request to roll back the configuration on for other controller and devices managed by an affected system. A successful exploit could allow the attacker to to roll back the configuration on for other controller and devices managed by an affected system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly addresses management of user identities and credentials throughout their lifecycle.
Covers policy-driven definition and review of user permissions and entitlements.
Supports proper user onboarding by binding verified identities to credentials.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Identity management directly governs the full lifecycle of user accounts, preventing incorrect user management.
Access rights provisioning and de-provisioning ensure users are correctly created, modified, and removed.
Responsibilities after termination or change of employment address removal of user access but not ongoing user management.
Privileged access rights assume correct user accounts exist; the control does not manage user creation or removal.
Access control policies rely on accurate user management but do not themselves define user lifecycle processes.
Information access restriction depends on properly managed users but does not address user management itself.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (1 rule)
- V-271707 OL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. prevents CWE-286
RHEL 9 (1 rule)
- V-257986 RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. prevents CWE-286