Riskcovery

CVE-2023-20135

State
Published
Severity
5.7 Medium
Published
Sep 13, 2023
Updated
Dec 16, 2025
Reserved
Oct 27, 2022

Read the record on cve.org

Description

A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. This vulnerability is due to a time-of-check, time-of-use (TOCTOU) race condition when an install query regarding an ISO image is performed during an install operation that uses an ISO image. An attacker could exploit this vulnerability by modifying an ISO image and then carrying out install requests in parallel. A successful exploit could allow the attacker to execute arbitrary code on an affected device.

Scores

CVSSScoreVectorSource
3.15.7 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Ncisco

Weaknesses

  • CWE-347 Improper Verification of Cryptographic Signature

Affected Products

ProductVersions
Cisco IOS XR SoftwareCisco
  • 7.5.3Affected
  • 7.5.2Affected
  • 7.5.4Affected
  • 7.7.1Affected
  • 7.7.2Affected
  • 7.7.21Affected
  • 7.8.1Affected
  • 7.8.2Affected
  • 7.9.1Affected
  • 7.9.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.