Denial of Service Vulnerability in Cisco Network Services Orchestrator

CVE-2023-20040

What is CVE-2023-20040?

A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) allows authenticated remote attackers to trigger a denial of service (DoS) condition on affected systems running as the root user. This issue arises from inadequate validation of user-supplied input during the package upload process. An attacker, with admin group access, can exploit this flaw by uploading a maliciously crafted package file, potentially leading to arbitrary file manipulations on the affected device's filesystem, including both file creations and deletions, thus causing service disruptions.

References