Vulnerability Details : CVE-2023-20003
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.
Products affected by CVE-2023-20003
- cpe:2.3:o:cisco:business_151axm_firmware:10.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_140ac_access_point_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_141acm_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_142acm_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_143acm_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_145ac_access_point_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_150ax_access_point_firmware:10.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:business_240ac_access_point_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-20003
0.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 2 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-20003
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.7
|
MEDIUM | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
2.8
|
1.4
|
Cisco Systems, Inc. | |
|
8.8
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-20003
-
The product requires authentication, but the product has an alternate path or channel that does not require authentication.Assigned by: ykramarz@cisco.com (Secondary)
-
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-20003
-
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbw-auth-bypass-ggnAfdZ
Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass VulnerabilityVendor Advisory
Jump to