CVE-2023-20029

CVSS V2 None CVSS V3 None
Description
A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Meraki onboarding feature of an affected device. An attacker could exploit this vulnerability by modifying the Meraki registration parameters. A successful exploit could allow the attacker to elevate privileges to root.
Overview
  • CVE ID
  • CVE-2023-20029
  • Assigner
  • ykramarz@cisco.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-23T17:15:13
  • Last Modified Date
  • 2023-04-05T18:54:11
Weakness Enumerations
CWE URL
NVD-CWE-noinfo http://cwe.mitre.org/data/definitions/NVD-noinfo.html
CWE-122 http://cwe.mitre.org/data/definitions/122.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:* 0 OR
References
Reference URL Reference Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-20029
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20029
History
Created Old Value New Value Data Type Notes
2023-04-17 03:15:46 Added to TrackCVE
2023-04-17 03:15:48 Weakness Enumeration new
2023-04-17 04:54:03 CVSS V3 information new