CVE-2023-20190

A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range encoding in the compression module of an ACL that is applied to an interface of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting. There are workarounds that address this vulnerability. This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2023 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication .

• CWE-264
• CWE-863

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-comp3acl-vGmp6BQ3Exploit, Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-comp3acl-vGmp6BQ3Exploit, Vendor Advisory

Published

Sep 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-20185A vulnerability in the Cisco ACI Multi-Site CloudSec encrypt…7.4
• CVE-2023-20186A vulnerability in the Authentication, Authorization, and Ac…9.1
• CVE-2023-20187A vulnerability in the Multicast Leaf Recycle Elimination (m…7.5
• CVE-2023-20188A vulnerability in the web-based management interface of Cis…4.8
• CVE-2023-20189Multiple vulnerabilities in the web-based user interface of …9.8
• CVE-2023-2019A flaw was found in the Linux kernel's netdevsim device driv…4.4
• CVE-2023-20191A vulnerability in the access control list (ACL) processing …7.5
• CVE-2023-20192Multiple vulnerabilities in Cisco Expressway Series and Cisc…7.7
• CVE-2023-20193A vulnerability in the Embedded Service Router (ESR) of Cisc…6.7
• CVE-2023-20194A vulnerability in the ERS API of Cisco ISE could allow an a…4.9
• CVE-2023-20195Two vulnerabilities in Cisco ISE could allow an authenticate…7.2
• CVE-2023-20196Two vulnerabilities in Cisco ISE could allow an authenticate…7.2