Cisco Modeling Labs External Authentication Vulnerability

CVE-2023-20154

Summary

A vulnerability exists in the external authentication mechanism of Cisco Modeling Labs, allowing an unauthenticated, remote attacker to compromise the web interface with administrative privileges. This issue arises from the improper handling of messages by the external authentication server, enabling an attacker to bypass the login process under specific conditions. By exploiting this flaw, an attacker could gain full access to the web interface, including the ability to modify simulations and user-generated data. It is essential that organizations using affected versions of Cisco Modeling Labs apply the latest software updates and consider available workarounds to mitigate the risk associated with this vulnerability.

References