CVE-2023-20210 — MEDIUM (6.0)

Vulnerability Description

A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device. The vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing a crafted command to the affected system. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, an attacker must have valid BroadWorks administrative privileges on the affected device.

CVSS Score

6.0

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Broadworks Application Delivery Platform Firmware	23.0
Cisco	Broadworks Application Delivery Platform	-
Cisco	Broadworks Application Server Firmware	23.0
Cisco	Broadworks Application Server	-
Cisco	Broadworks Database Server Firmware	23.0
Cisco	Broadworks Database Server	-
Cisco	Broadworks Database Troubleshooting Server Firmware	23.0
Cisco	Broadworks Database Troubleshooting Server	-
Cisco	Broadworks Execution Server Firmware	23.0
Cisco	Broadworks Execution Server	-
Cisco	Broadworks Media Server Firmware	23.0
Cisco	Broadworks Media Server	-
Cisco	Broadworks Messaging Server Firmware	23.0
Cisco	Broadworks Messaging Server	-
Cisco	Broadworks Network Database Server Firmware	23.0
Cisco	Broadworks Network Database Server	-
Cisco	Broadworks Network Function Manager Firmware	23.0
Cisco	Broadworks Network Function Manager	-
Cisco	Broadworks Network Server Firmware	23.0
Cisco	Broadworks Network Server	-

Related Weaknesses (CWE)

CWE-250

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory

FAQ

What is CVE-2023-20210?

CVE-2023-20210 is a vulnerability with a CVSS score of 6.0 (MEDIUM). A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device. The vulnerability is due to insufficient input validat...

How severe is CVE-2023-20210?

CVE-2023-20210 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-20210?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Broadworks Application Delivery Platform Firmware, Cisco Broadworks Application Delivery Platform, Cisco Broadworks Application Server Firmware, Cisco Broadworks Application Server, Cisco Broadworks Database Server Firmware.