Rewterz Threat Advisory – Multiple Cisco Products Vulnerabilities

September 29, 2023

Severity

High

Analysis Summary

CVE-2023-20033 CVSS: 8.6

Cisco IOS XE Software for Catalyst 3650 and Catalyst 3850 Series Switches is vulnerable to a denial of service, caused by improper resource management. By sending a high rate of traffic to the management interface, a remote attacker could exploit this vulnerability to cause the device to reload.

CVE-2023-20034 CVSS: 7.5

Cisco Catalyst SD-WAN Manager could allow a remote attacker to obtain sensitive information, caused by improper access control on Cisco Catalyst SD-WAN Manager for the Elasticsearch service. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to view the Elasticsearch database content as the Elasticsearch user.

CVE-2023-20202 CVSS: 6.1

Cisco IOS XE Software is vulnerable to a denial of service, caused by improper memory management in Wireless Network Control daemon (wncd). By sending a series of network requests, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-20252 CVSS: 9.8

Cisco Catalyst SD-WAN Manager could allow a remote attacker to bypass security restrictions, caused by improper authentication checks for SAML APIs. By sending requests directly to the SAML APIs, an attacker could exploit this vulnerability to generate an authorization token sufficient to access the application and obtain administrative access.

CVE-2023-20251 CVSS: 6.1

Cisco Wireless LAN Controller AireOS Software is vulnerable to a denial of service, caused by memory leaks caused by multiple clients connecting under specific conditions. By causing multiple wireless clients to attempt to connect to an access point (AP), a remote attacker could exploit this vulnerability to cause device reboot.

CVE-2023-20231 CVSS: 8.8

Cisco IOS XE Software could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By sending specially crafted input to the web UI, an attacker could exploit this vulnerability to execute arbitrary CLI commands with level 15 privileges.

CVE-2023-20268 CVSS: 4.7

Cisco Access Point Software is vulnerable to a denial of service, caused by insufficient management of resources when handling certain types of traffic. By sending a series of specific wireless packets, a remote attacker could exploit this vulnerability to exhaust resources on an affected device.

CVE-2023-20109 CVSS: 6.6

Cisco IOS and IOS XE Software Cisco Group Encrypted Transport VPN Software could allow a remote authenticated attacker to execute arbitrary code on the system, caused by insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2023-20254 CVSS: 7.2

Cisco Catalyst SD-WAN Manager could allow a remote authenticated attacker to bypass security restrictions, caused by insufficient user session management within the Cisco Catalyst SD-WAN Manager system. By sending a specially crafted request, an attacker could exploit this vulnerability to access information about another tenant, make configuration changes, or possibly take a tenant offline and cause a denial of service.

CVE-2023-20223 CVSS: 8.6

Cisco DNA Center could allow a remote attacker to bypass security restrictions, caused by improper access control enforcement on API requests. By sending a specially crafted API request, an attacker could exploit this vulnerability to read and modify data that is handled by an internal service.

CVE-2023-20179 CVSS: 4.3

Cisco Catalyst SD-WAN Manager is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2023-20262 CVSS: 5.3

Cisco Catalyst SD-WAN Manager is vulnerable to a denial of service, caused by insufficient resource management when an affected system is in an error condition in the SSH service. By sending malicious traffic to the affected system, a remote attacker could exploit this vulnerability to cause the SSH process to crash and restart, resulting in a denial of service.

CVE-2023-20187 CVSS: 8.6

Cisco IOS XE Software for ASR 1000 Series Aggregation Services Routers is vulnerable to a denial of service, caused by improper handling of certain IPv6 multicast packets. By sending a specially crafted IPv6 multicast or IPv6 multicast VPN (MVPNv6) packet, a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVE-2023-20176 CVSS: 5.8

Cisco Catalyst 9100 Access Points is vulnerable to a denial of service, caused by overuse of AP resources. By sending a high rate of traffic over an extended period of time, a remote attacker could exploit this vulnerability to cause a temporary disruption of service.

CVE-2023-20227 CVSS: 8.6

Cisco IOS XE Software is vulnerable to a denial of service, caused by improper handling of certain L2TP packets. By sending specially crafted L2TP packets, a remote attacker could exploit this vulnerability to cause the device to reload unexpectedly.

CVE-2023-20253 CVSS: 8.4

Cisco Catalyst SD-WAN Manager could allow a local authenticated attacker to bypass security restrictions, caused by improper access control enforcement on the Cisco Catalyst SD-WAN Manager CLI. By initiating a configuration rollback on the Cisco Catalyst SD-WAN Manager controller, an attacker could exploit this vulnerability to roll back the configuration on an affected Cisco Catalyst SD-WAN Manager instance, which could then be deployed to the downstream routers.

CVE-2023-20226 CVSS: 8.6

Cisco IOS XE Software is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted packet stream, a remote attacker could exploit this vulnerability to cause the device to reload.

CVE-2023-20186 CVSS: 8.0

Cisco IOS and IOS XE Software could allow a remote authenticated attacker to bypass security restrictions, caused by incorrect processing of SCP commands in AAA command authorization checks. By sending a specially crafted SCP commands, an attacker could exploit this vulnerability to obtain or change the configuration on system.

Impact

Denial of Service
Information Disclosure
Security Bypass
Command Execution
Code Execution
Cross-Site Scripting

Indicators Of Compromise

CVE

CVE-2023-20033
CVE-2023-20034
CVE-2023-20202
CVE-2023-20252
CVE-2023-20251
CVE-2023-20231
CVE-2023-20268
CVE-2023-20109
CVE-2023-20254
CVE-2023-20223
CVE-2023-20179
CVE-2023-20262
CVE-2023-20187
CVE-2023-20176
CVE-2023-20227
CVE-2023-20253
CVE-2023-20226
CVE-2023-20186

Affected Vendors

Cisco

Affected Products

Cisco Catalyst 8200 Series Edge Platforms
CIsco 4000 Series Integrated Services Routers
Cisco 1000 Series Integrated Services Routers (ISRs)
Cisco ASR 1000 Series Aggregation Services Routers
Cisco DNA Center
Cisco IOS Software
Cisco Catalyst 9400 Series Switches
Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9300 Series Switches
Cisco Catalyst 9500 Series Switches
Cisco Catalyst 9300 Series Switches
Cisco IOS XE Software
Cisco ISR1100 Series Routers
Cisco Catalyst IR8300 Rugged Series Routers
Cisco 4300 Integrated Services Routers
Cisco 4200 Integrated Services Routers
Cisco VG450 Analog Voice Gateways
Cisco VG420 Analog Voice Gateways
Cisco VG400 Analog Voice Gateways
Cisco Cloud Services Routers 1000V Series
Cisco Catalyst 8500L Edge Platforms
Cisco Catalyst 8300 Series Edge Platforms
Cisco Catalyst 8000V Edge Software
Cisco Integrated Services Virtual Routers
Cisco 1100 Integrated Services Routers
Cisco Access Point Software
Cisco Embedded Wireless Controller on Catalyst 9100X Series Access Points
Cisco Catalyst 9100 Access Points
Cisco Catalyst 9800-CL Wireless Controllers for Cloud
Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9500 Series Switches
Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9400 Series Switches
Cisco Wireless LAN Controller (WLC) AireOS Software
Cisco Catalyst SD-WAN Manager 20.12
Cisco Catalyst SD-WAN Manager 20.11.1.2
Cisco Catalyst SD-WAN Manager 20.11.1
Cisco Catalyst SD-WAN Manager 20.3
Cisco Catalyst SD-WAN Manager 20.3.4
Cisco Catalyst SD-WAN Manager 20.4
Cisco Catalyst SD-WAN Manager 20.5
Cisco Catalyst SD-WAN Manager 20.6
Cisco Catalyst SD-WAN Manager 20.7
Cisco Catalyst SD-WAN Manager 20.2
Cisco Catalyst SD-WAN Manager 20.9.3.2
Cisco Catalyst SD-WAN Manager 20.9
Cisco Catalyst SD-WAN Manager 20.9.1
Cisco Catalyst SD-WAN Manager 20.8
Cisco Catalyst SD-WAN Manager 20.11
Cisco Catalyst SD-WAN Manager 20.10
Cisco Catalyst SD-WAN Manager 20.9.3
Cisco Catalyst 3850 Series Switches
Cisco Catalyst 3650 Series Switches