8.8
Élevée
CVE-2023-20046 A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated,…
Description
A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user. There are workarounds that address this vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco ASR 5000 Series Software 21.28 | 21.28.m0 → 21.28.2 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.27 | 21.27.m0 → 21.27.5 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.26 | 21.26.0 → 21.26.17 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.25 | 21.25.0 → 21.25.14 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.24 | 21.24.0 → 21.24.3 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.23 | 21.23.n6 → 21.23.30 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.22 | 21.22.ua0 → 21.22.13 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.21 | 21.21.KS2 → 21.21.3 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.20 | 21.20.SV1 → 21.20.p9 | Pas de correctif indiqué |
Afficher les 10 autres branches Masquer les 10 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco ASR 5000 Series Software 21.19 | 21.19.n2 → 21.19.11 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.18 | 21.18.0 → 21.18.26 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.17 | 21.17.0 → 21.17.19 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.16 | 21.16.d0 → 21.16.10 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.15 | 21.15.0 → 21.15.60 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.14 | 21.14.b12 → 21.14.23 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.13 | 21.13.0 → 21.13.21 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.12 | 21.12.0 → 21.12.22 | Pas de correctif indiqué |
| Cisco ASR 5000 Series Software 21.11 | 21.11.0 → 21.11.21 | Pas de correctif indiqué |
| Cisco Ultra Cloud Core - User Plane Function | Versions non publiées |
Références
- cisco-sa-staros-ssh-privesc-BmWeJC3h sec.cloudapps.cisco.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Cisco ASR 5000 Series Software
Les 15 CVE de Cisco ASR 5000 Series Software →
CVE-2021-1424
A vulnerability in the ipsecmgr process of Cisco ASR 5000 Series Software (StarOS) could allow an…
5.3
Moyenne
CVE-2023-20051
A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an…
5.8
Moyenne
CVE-2022-20665
A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an…
6.0
Moyenne
CVE-2021-1540
Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an…
8.1
Élevée