CVE-2023-20065

State: Published
Severity: 7.8 High
Published: Mar 23, 2023
Updated: Aug 2, 2024
Reserved: Oct 27, 2022

Description

A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to insufficient restrictions on the hosted application. An attacker could exploit this vulnerability by logging in to and then escaping the Cisco IOx application container. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	16.4.1Affected 16.4.2Affected 16.4.3Affected 17.3.1Affected 17.3.2Affected 17.3.3Affected 17.3.1aAffected 17.3.1wAffected 17.3.2aAffected 17.3.1xAffected 17.3.1zAffected 17.3.4Affected 17.3.5Affected 17.3.4aAffected 17.3.6Affected 17.3.4bAffected 17.3.4cAffected 17.3.5aAffected 17.3.5bAffected 17.4.1Affected 17.4.2Affected 17.4.1aAffected 17.4.1bAffected 17.4.2aAffected 17.5.1Affected and 25 more versions

Product

Versions

Cisco IOS XE SoftwareCisco

16.4.1Affected
16.4.2Affected
16.4.3Affected
17.3.1Affected
17.3.2Affected
17.3.3Affected
17.3.1aAffected
17.3.1wAffected
17.3.2aAffected
17.3.1xAffected
17.3.1zAffected
17.3.4Affected
17.3.5Affected
17.3.4aAffected
17.3.6Affected
17.3.4bAffected
17.3.4cAffected
17.3.5aAffected
17.3.5bAffected
17.4.1Affected
17.4.2Affected
17.4.1aAffected
17.4.1bAffected
17.4.2aAffected
17.5.1Affected
and 25 more versions

References

cisco-sa-iox-priv-escalate-Xg8zkyPk

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.