CVE-2023-20190

Summary

CVE-2023-20190 is a vulnerability affecting the classic access control list (ACL) compression feature in Cisco IOS XR Software. An unauthenticated, remote attacker can exploit this issue by sending misencoded traffic that bypasses the protections offered by a configured ACL. The vulnerability arises due to incorrect destination address range encoding in the compression module of an affected device's ACL. A successful exploit could enable an attacker to bypass the device's ACL protections, potentially granting access to trusted networks that the device is meant to secure. Workarounds are available to mitigate this risk. This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For more information, please visit Cisco Event Response.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.