4.4
Medium
CVE-2023-20216 A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an…
Description
A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a user with the BWORKS or BWSUPERADMIN role and issuing crafted commands on an affected system. A successful exploit could allow the attacker to execute commands beyond the sphere of their intended access level, including initiating installs or running operating system commands with elevated permissions. There are workarounds that address this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco BroadWorks | 23.0 | No fix stated |
| Cisco BroadWorks | 22.0 | No fix stated |
| Cisco BroadWorks | 21.0 | No fix stated |
| Cisco BroadWorks | 21.sp1 | No fix stated |
References
- cisco-sa-bw-priv-esc-qTgUZOsQ sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco BroadWorks
The 21 CVEs of Cisco BroadWorks →
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow…
6.5
Medium
CVE-2026-20320
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote…
7.5
High
CVE-2025-20307
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow…
4.8
Medium
CVE-2025-20211
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an…
6.1
Medium