SFTP Server Logic Flaw in Cisco Nexus Series Switches
CVE-2023-20115

5.4MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Nx-os Software
Vendor
CVE Published:
23 August 2023

Badges

👾 Exploit Exists

What is CVE-2023-20115?

A security vulnerability in the SFTP server implementation of Cisco Nexus 3000 and 9000 Series Switches allows authenticated, remote users to exploit a logic error when user roles are verified upon establishing an SFTP connection. This oversight could enable an attacker to download or overwrite files in the device's underlying operating system by authenticating as a non-administrator user. Although there are workarounds available to mitigate this risk, it is essential to apply the recommended updates to safeguard your network.

Affected Version(s)

Cisco NX-OS Software 9.2(1)

Cisco NX-OS Software 9.2(2)

Cisco NX-OS Software 9.2(2t)

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.