Vulnerability Description
A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user. This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | < 17.3.1 |
| Cisco | Catalyst Ie3200 Rugged Switch | - |
| Cisco | Catalyst Ie3300 Rugged Switch | - |
| Cisco | Catalyst Ie3400 Rugged Switch | - |
| Cisco | Catalyst Ir1101 | - |
| Cisco | Catalyst Ir1821-K9 | - |
| Cisco | Catalyst Ir1831-K9 | - |
| Cisco | Catalyst Ir1833-K9 | - |
| Cisco | Catalyst Ir1835-K9 | - |
| Cisco | Catalyst Ir8140H-K9 | - |
| Cisco | Catalyst Ir8140H-P-K9 | - |
| Cisco | Catalyst Ir8340-K9 | - |
| Cisco | Ess-3300-24T-Con-A | - |
| Cisco | Ess-3300-24T-Con-E | - |
| Cisco | Ess-3300-24T-Ncp-A | - |
| Cisco | Ess-3300-24T-Ncp-E | - |
| Cisco | Ess-3300-Con-A | - |
| Cisco | Ess-3300-Con-E | - |
| Cisco | Ess-3300-Ncp-A | - |
| Cisco | Ess-3300-Ncp-E | - |
Related Weaknesses (CWE)
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory
FAQ
What is CVE-2023-20235?
CVE-2023-20235 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to...
How severe is CVE-2023-20235?
CVE-2023-20235 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-20235?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco Catalyst Ie3200 Rugged Switch, Cisco Catalyst Ie3300 Rugged Switch, Cisco Catalyst Ie3400 Rugged Switch, Cisco Catalyst Ir1101.