Privilege Escalation Vulnerability in Cisco StarOS Software
CVE-2023-20046

8.8HIGH

Key Information:

Vendor

Cisco
Status
Cisco ASR 5000 Series Software
Cisco Ultra Cloud Core - User Plane Function
Vendor
CVE Published:
9 May 2023

What is CVE-2023-20046?

A security flaw exists in the key-based SSH authentication mechanism of Cisco StarOS Software that could allow an authenticated remote attacker to gain elevated privileges. This issue arises due to inadequate validation of user-provided credentials. An attacker can exploit this by submitting a valid SSH key with low privileges while impersonating a high-privileged user account from a configured source IP. If successful, this would enable unauthorized access to the device as a high-privileged user. Mitigations are available to address this issue.

Affected Version(s)

Cisco ASR 5000 Series Software 21.11.0

Cisco ASR 5000 Series Software 21.11.1

Cisco ASR 5000 Series Software 21.11.2

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.