Privilege Elevation Vulnerability in Cisco BroadWorks Servers

CVE-2023-20216

What is CVE-2023-20216?

A significant vulnerability in Cisco BroadWorks server types allows an authenticated local attacker to escalate privileges to root level. This issue arises from improper implementation of user role permissions, particularly for users assigned BWORKS or BWSUPERADMIN roles. An attacker can exploit this flaw by issuing specially crafted commands after gaining access, potentially executing actions outside their intended access, such as installing software or running critical operating system commands. While there are workarounds available, immediate action is recommended to mitigate any risk.

References