1. Home
  2. CVE Database
  3. CVE-2023-20169
HIGH · 7.4

CVE-2023-20169

A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone N...

Vulnerability Description

A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload. This vulnerability is due to insufficient input validation when parsing an ingress IS-IS packet. An attacker could exploit this vulnerability by sending a crafted IS-IS packet to an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the unexpected restart of the IS-IS process, which could cause the affected device to reload. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2 adjacent to the affected device.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
CiscoNx-Os10.3\(2\)
CiscoNexus 3048-
CiscoNexus 31108Pc-V-
CiscoNexus 31108Tc-V-
CiscoNexus 31128Pq-
CiscoNexus 3132C-Z-
CiscoNexus 3132Q-V-
CiscoNexus 3132Q-Xl-
CiscoNexus 3164Q-
CiscoNexus 3172Pq-
CiscoNexus 3172Pq-Xl-
CiscoNexus 3172Tq-
CiscoNexus 3172Tq-32T-
CiscoNexus 3172Tq-Xl-
CiscoNexus 3232-
CiscoNexus 3264C-E-
CiscoNexus 3264Q-
CiscoNexus 3408-S-
CiscoNexus 34180Yc-
CiscoNexus 34200Yc-Sm-

Related Weaknesses (CWE)

CWE-788CWE-20

References

FAQ

What is CVE-2023-20169?

CVE-2023-20169 is a vulnerability with a CVSS score of 7.4 (HIGH). A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone N...

How severe is CVE-2023-20169?

CVE-2023-20169 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-20169?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Nx-Os, Cisco Nexus 3048, Cisco Nexus 31108Pc-V, Cisco Nexus 31108Tc-V, Cisco Nexus 31128Pq.