CVE-2023-20016

CVSS V2 None CVSS V3 None

Description

A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method used for the backup function. An attacker could exploit this vulnerability by leveraging a static key used for the backup configuration feature. A successful exploit could allow the attacker to decrypt sensitive information that is stored in full state and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and other credentials.

Overview

CVE ID
CVE-2023-20016

Assigner
ykramarz@cisco.com

Vulnerability Status
Analyzed

Published Version
2023-02-23T20:15:13

Last Modified Date
2023-03-13T16:29:00

Weakness Enumerations

CWE	URL
CWE-330	http://cwe.mitre.org/data/definitions/330.html
CWE-321	http://cwe.mitre.org/data/definitions/321.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6536_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6536:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_64108_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_64108:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6454_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6454:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6200_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6200:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6248up_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6248up:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6296up_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6296up:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6300_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6300:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6324_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6324:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6332_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6332:-:::::::*	0	OR
		AND
cpe:2.3:a:cisco:ucs_central_software::::::::	1	OR	4.2\(3c\)
cpe:2.3:o:cisco:ucs_6332-16up_firmware:-:::::::*	1	OR
cpe:2.3:h:cisco:ucs_6332-16up:-:::::::*	0	OR
		AND
cpe:2.3:o:cisco:fxos::::::::	1	OR	2.6.1
cpe:2.3:h:cisco:firepower_4100:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4110:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4112:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4115:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4120:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4125:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4140:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4145:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_4150:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-24:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-36:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-40:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-44:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-44_x_3:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-48:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-56:-:::::::*	0	OR
cpe:2.3:h:cisco:firepower_9300_sm-56_x_3:-:::::::*	0	OR

References

Reference URL	Reference Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsm-bkpsky-H8FCQgsA	Vendor Advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-20016
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20016

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 05:23:07				Added to TrackCVE
2023-04-17 05:23:09			Weakness Enumeration	new