CVE-2023-20190
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2023-20190 is a vulnerability affecting the classic access control list (ACL) compression feature in Cisco IOS XR Software. An unauthenticated, remote attacker can exploit this issue by sending misencoded traffic that bypasses the protections offered by a configured ACL. The vulnerability arises due to incorrect destination address range encoding in the compression module of an affected device's ACL. A successful exploit could enable an attacker to bypass the device's ACL protections, potentially granting access to trusted networks that the device is meant to secure. Workarounds are available to mitigate this risk. This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For more information, please visit Cisco Event Response.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Cisco IOS
- Cisco IOS XR
Affected Vendors
- Cisco Systems Inc
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions