Lucene search

CiscoCVE-2023-20003

HistoryMay 18, 2023 - 3:15 a.m.

CVE-2023-20003

2023-05-1803:15:09

CWE-306

CWE-288

cisco

web.nvd.nist.gov

cve-2023-20003

cisco

business

wireless access points

vulnerability

authentication bypass

logic error

guest portal

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

32.6%

JSON

A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.

Affected configurations

Nvd

Node

ciscobusiness_140ac_access_point_firmwareRange<10.8.1.0

AND

ciscobusiness_140ac_access_pointMatch-

Node

ciscobusiness_141acm_firmwareRange<10.8.1.0

AND

ciscobusiness_141acmMatch-

Node

ciscobusiness_142acm_firmwareRange<10.8.1.0

AND

ciscobusiness_142acmMatch-

Node

ciscobusiness_143acm_firmwareRange<10.8.1.0

AND

ciscobusiness_143acmMatch-

Node

ciscobusiness_151axm_firmwareMatch10.4.2

AND

ciscobusiness_151axmMatch-

Node

ciscobusiness_145ac_access_point_firmwareRange<10.8.1.0

AND

ciscobusiness_145ac_access_pointMatch-

Node

ciscobusiness_150ax_access_point_firmwareMatch10.4.2

AND

ciscobusiness_150ax_access_pointMatch-

Node

ciscobusiness_240ac_access_point_firmwareRange<10.8.1.0

AND

ciscobusiness_240ac_access_pointMatch-

VendorProductVersionCPE
ciscobusiness_140ac_access_point_firmware*cpe:2.3:o:cisco:business_140ac_access_point_firmware:*:*:*:*:*:*:*:*
ciscobusiness_140ac_access_point-cpe:2.3:h:cisco:business_140ac_access_point:-:*:*:*:*:*:*:*
ciscobusiness_141acm_firmware*cpe:2.3:o:cisco:business_141acm_firmware:*:*:*:*:*:*:*:*
ciscobusiness_141acm-cpe:2.3:h:cisco:business_141acm:-:*:*:*:*:*:*:*
ciscobusiness_142acm_firmware*cpe:2.3:o:cisco:business_142acm_firmware:*:*:*:*:*:*:*:*
ciscobusiness_142acm-cpe:2.3:h:cisco:business_142acm:-:*:*:*:*:*:*:*
ciscobusiness_143acm_firmware*cpe:2.3:o:cisco:business_143acm_firmware:*:*:*:*:*:*:*:*
ciscobusiness_143acm-cpe:2.3:h:cisco:business_143acm:-:*:*:*:*:*:*:*
ciscobusiness_151axm_firmware10.4.2cpe:2.3:o:cisco:business_151axm_firmware:10.4.2:*:*:*:*:*:*:*
ciscobusiness_151axm-cpe:2.3:h:cisco:business_151axm:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	business_140ac_access_point_firmware	*	cpe:2.3:o:cisco:business_140ac_access_point_firmware::::::::
cisco	business_140ac_access_point	-	cpe:2.3:h:cisco:business_140ac_access_point:-:::::::*
cisco	business_141acm_firmware	*	cpe:2.3:o:cisco:business_141acm_firmware::::::::
cisco	business_141acm	-	cpe:2.3:h:cisco:business_141acm:-:::::::*
cisco	business_142acm_firmware	*	cpe:2.3:o:cisco:business_142acm_firmware::::::::
cisco	business_142acm	-	cpe:2.3:h:cisco:business_142acm:-:::::::*
cisco	business_143acm_firmware	*	cpe:2.3:o:cisco:business_143acm_firmware::::::::
cisco	business_143acm	-	cpe:2.3:h:cisco:business_143acm:-:::::::*
cisco	business_151axm_firmware	10.4.2	cpe:2.3:o:cisco:business_151axm_firmware:10.4.2:::::::*
cisco	business_151axm	-	cpe:2.3:h:cisco:business_151axm:-:::::::*

Rows per page:

1-10 of 161

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Business Wireless Access Point Software ",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbw-auth-bypass-ggnAfdZ

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

32.6%

JSON

Related for CVE-2023-20003