Privilege Escalation Vulnerability in Cisco StarOS Software

CVE-2023-20046

Summary

A security flaw exists in the key-based SSH authentication mechanism of Cisco StarOS Software that could allow an authenticated remote attacker to gain elevated privileges. This issue arises due to inadequate validation of user-provided credentials. An attacker can exploit this by submitting a valid SSH key with low privileges while impersonating a high-privileged user account from a configured source IP. If successful, this would enable unauthorized access to the device as a high-privileged user. Mitigations are available to address this issue.

References