Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-20169

Quick assessment

Affected
Cisco Cisco NX-OS Software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cisco NX-OS Software等都是美国思科（Cisco）公司的产品。Cisco NX-OS Software是一套交换机使用的数据中心级操作系统软件。Cisco Nexus 3000 Series Switches是一款3000系列交换机。Cisco Nexus 9000 Series Switches是一款9000系列交换机。 Cisco 多款产品存在安全漏洞，该漏洞源于IS-IS协议存在安全漏洞。攻击者可利用该漏洞通过发送IS-IS数据包来导致系统拒绝服务（DoS）。以下产品及版本受到影响

CVSS 7.4 · High EPSS 0.33% · P24

Possible ATT&CK Techniques 1 AI

T1498.002 · Reflection Amplification
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-20169

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload. This vulnerability is due to insufficient input validation when parsing an ingress IS-IS packet. An attacker could exploit this vulnerability by sending a crafted IS-IS packet to an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the unexpected restart of the IS-IS process, which could cause the affected device to reload. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2 adjacent to the affected device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在缓冲区结束位置之后访问内存
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco 多款产品输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco NX-OS Software等都是美国思科（Cisco）公司的产品。Cisco NX-OS Software是一套交换机使用的数据中心级操作系统软件。Cisco Nexus 3000 Series Switches是一款3000系列交换机。Cisco Nexus 9000 Series Switches是一款9000系列交换机。 Cisco 多款产品存在安全漏洞，该漏洞源于IS-IS协议存在安全漏洞。攻击者可利用该漏洞通过发送IS-IS数据包来导致系统拒绝服务（DoS）。以下产品及版本受到影响
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cisco Cisco NX-OS Software 10.3(2) -

II. Public POCs for CVE-2023-20169

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-20169

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-20169 (1)

Same Patch Batch · Cisco · 2023-08-23 · 6 CVEs total

CVE-2023-20200 7.7 HIGH Cisco 多款产品安全漏洞
CVE-2023-20168 7.1 HIGH Cisco NX-OS Software 输入验证错误漏洞
CVE-2023-20230 5.4 MEDIUM Cisco Application Policy Infrastructure Controller 安全漏洞
CVE-2023-20115 5.4 MEDIUM Cisco Nexus Series Switches 安全漏洞
CVE-2023-20234 4.4 MEDIUM Cisco FXOS Software 安全漏洞

IV. Related Vulnerabilities

Same product: Cisco NX-OS Software
Same vendor: Cisco
Same weakness: CWE-788

V. Comments for CVE-2023-20169

No comments yet

Leave a comment