CVE-2023-20135

2023-09-1317:15:09

CWE-367

CWE-347

[email protected]

web.nvd.nist.gov

cve-2023-20135

cisco

ios xr software

vulnerability

image verification

toctou

race condition

install operation

iso image

nvd

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system.

This vulnerability is due to a time-of-check, time-of-use (TOCTOU) race condition when an install query regarding an ISO image is performed during an install operation that uses an ISO image. An attacker could exploit this vulnerability by modifying an ISO image and then carrying out install requests in parallel. A successful exploit could allow the attacker to execute arbitrary code on an affected device.

Affected configurations

NVD

Node

ciscoios_xrRange7.5.2–7.6

ciscoios_xrRange7.7–7.10.1

CPENameOperatorVersion
cisco:ios_xrcisco ios xrlt7.6
cisco:ios_xrcisco ios xrlt7.10.1

CPE	Name	Operator	Version
cisco:ios_xr	cisco ios xr	lt	7.6
cisco:ios_xr	cisco ios xr	lt	7.10.1

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco IOS XR Software",
    "versions": [
      {
        "version": "7.5.3",
        "status": "affected"
      },
      {
        "version": "7.5.2",
        "status": "affected"
      },
      {
        "version": "7.5.4",
        "status": "affected"
      },
      {
        "version": "7.7.1",
        "status": "affected"
      },
      {
        "version": "7.7.2",
        "status": "affected"
      },
      {
        "version": "7.7.21",
        "status": "affected"
      },
      {
        "version": "7.8.1",
        "status": "affected"
      },
      {
        "version": "7.8.2",
        "status": "affected"
      },
      {
        "version": "7.9.1",
        "status": "affected"
      },
      {
        "version": "7.9.2",
        "status": "affected"
      }
    ]
  }
]