Strix
26.1K

CVE-2023-20076

HIGHCVSS 8.8/10EPSS 1.51%

Last modified

CVE-2023-20076 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. EPSS estimates a 1.51% chance of exploitation in the next 30 days.

Description

A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.51%

71.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoIc3000 Industrial Compute Gateway< 1.4.2
CiscoIoxAll versions
CiscoIos Xe< 17.6.5
CiscoIos Xe>= 17.9.0, < 17.9.2
CiscoIos Xe17.10.0
CiscoCgr1240 Firmware< 1.16.0.1
CiscoCgr1000 Firmware< 1.16.0.1
CiscoIr510 Wpan Firmware< 1.10.0.1
Cisco829 Industrial Integrated Services Router Firmware< 15.9\(3\)
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m1
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m2
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m2a
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m3
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m4
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m4a
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m5
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m6a
Cisco829 Industrial Integrated Services Router Firmware15.9\(3\)m6b
Cisco807 Industrial Integrated Services Router Firmware< 15.9\(3\)
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m1
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m2
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m2a
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m3
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m4
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m4a
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m5
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m6a
Cisco807 Industrial Integrated Services Router Firmware15.9\(3\)m6b
Cisco809 Industrial Integrated Services Router Firmware< 15.9\(3\)
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m1
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m2
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m2a
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m3
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m4
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m4a
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m5
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m6a
Cisco809 Industrial Integrated Services Router Firmware15.9\(3\)m6b

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-20076?
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters that are passed in for activation of an application. An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system.
How severe is CVE-2023-20076?
CVE-2023-20076 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.51% probability of exploitation in the next 30 days.
How do I fix CVE-2023-20076?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-20076?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST