Riskcovery

CVE-2023-20235

State
Published
Severity
6.5 Medium
Published
Oct 4, 2023
Updated
Feb 25, 2026
Reserved
Oct 27, 2022

Read the record on cve.org

Description

A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user. This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Ncisco

Weaknesses

  • CWE-552 Files or Directories Accessible to External Parties

Affected Products

ProductVersions
Cisco IOS XE SoftwareCisco
  • 17.3.1Affected
  • 17.3.2Affected
  • 17.3.3Affected
  • 17.3.1aAffected
  • 17.3.1wAffected
  • 17.3.2aAffected
  • 17.3.1xAffected
  • 17.3.1zAffected
  • 17.3.4Affected
  • 17.3.5Affected
  • 17.3.4aAffected
  • 17.3.6Affected
  • 17.3.4bAffected
  • 17.3.4cAffected
  • 17.3.5aAffected
  • 17.3.5bAffected
  • 17.3.7Affected
  • 17.4.1Affected
  • 17.4.2Affected
  • 17.4.1aAffected
  • 17.4.1bAffected
  • 17.4.2aAffected
  • 17.5.1Affected
  • 17.5.1aAffected
  • 17.5.1bAffected
  • and 41 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.