Vulnerability Details : CVE-2023-20082

A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. This vulnerability is due to errors that occur when retrieving the public release key that is used for image signature verification. An attacker could exploit this vulnerability by modifying specific variables in the Serial Peripheral Interface (SPI) flash memory of an affected device. A successful exploit could allow the attacker to execute persistent code on the underlying operating system. Note: In Cisco IOS XE Software releases 16.11.1 and later, the complexity of an attack using this vulnerability is high. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software on a device to a release that would lower the attack complexity.

Published 2023-03-23 17:15:15

Updated 2023-03-30 20:35:48

Source Cisco Systems, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-20082

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 18 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2023-20082

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.1	MEDIUM	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	0.9	5.2	[email protected]
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	[email protected]
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-20082

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: [email protected] (Secondary)

References for CVE-2023-20082

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9300-spi-ace-yejYgnNQ

Vendor Advisory

Products affected by CVE-2023-20082

Cisco » Ios Xe
Versions from including (>=) 17.4 and before (<) 17.6.5
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 9300 » Version: N/A
When used together with: Cisco » Catalyst 9300-24p-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24p-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24s-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24s-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24t-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24t-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24u-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24u-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24ux-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24ux-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48p-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48p-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48s-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48s-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48t-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48t-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48u-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48u-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48un-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48un-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48uxm-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48uxm-e » Version: N/A
When used together with: Cisco » Catalyst 9300l » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l Stack » Version: N/A
When used together with: Cisco » Catalyst 9300lm » Version: N/A
When used together with: Cisco » Catalyst 9300x » Version: N/A
Cisco » Ios Xe
Versions before (<) 17.3.7
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 9300 » Version: N/A
When used together with: Cisco » Catalyst 9300-24p-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24p-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24s-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24s-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24t-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24t-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24u-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24u-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24ux-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24ux-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48p-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48p-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48s-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48s-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48t-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48t-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48u-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48u-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48un-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48un-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48uxm-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48uxm-e » Version: N/A
When used together with: Cisco » Catalyst 9300l » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l Stack » Version: N/A
When used together with: Cisco » Catalyst 9300lm » Version: N/A
When used together with: Cisco » Catalyst 9300x » Version: N/A
Cisco » Ios Xe » Version: 17.7
cpe:2.3:o:cisco:ios_xe:17.7:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 9300 » Version: N/A
When used together with: Cisco » Catalyst 9300-24p-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24p-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24s-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24s-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24t-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24t-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24u-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24u-e » Version: N/A
When used together with: Cisco » Catalyst 9300-24ux-a » Version: N/A
When used together with: Cisco » Catalyst 9300-24ux-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48p-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48p-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48s-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48s-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48t-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48t-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48u-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48u-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48un-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48un-e » Version: N/A
When used together with: Cisco » Catalyst 9300-48uxm-a » Version: N/A
When used together with: Cisco » Catalyst 9300-48uxm-e » Version: N/A
When used together with: Cisco » Catalyst 9300l » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24p-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-24t-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48p-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4g-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4g-e » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4x-a » Version: N/A
When used together with: Cisco » Catalyst 9300l-48t-4x-e » Version: N/A
When used together with: Cisco » Catalyst 9300l Stack » Version: N/A
When used together with: Cisco » Catalyst 9300lm » Version: N/A
When used together with: Cisco » Catalyst 9300x » Version: N/A