CVE-2023-20266

A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:emergency_responder:12.5.1su4:::::::*
	cpe:2.3:a:cisco:emergency_responder:12.5.1su8a:::::::*
	cpe:2.3:a:cisco:emergency_responder:14su3:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8::::-:::
	cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8::::session_management:::
	cpe:2.3:a:cisco:unity_connection:12.5\(1\)su6:::::::*
	cpe:2.3:a:cisco:unity_connection:12.5\(1\)su7:::::::*
	cpe:2.3:a:cisco:unity_connection:12.5\(1\)su8:::::::*
	cpe:2.3:a:cisco:unity_connection:14su2:::::::*
	cpe:2.3:a:cisco:unity_connection:14su3:::::::*

History

No history.

Information

Published : 2023-08-30 17:15

Updated : 2024-01-25 17:15

NVD link : CVE-2023-20266

Mitre link : CVE-2023-20266

CVE.ORG link : CVE-2023-20266

JSON object : View

Products Affected

cisco

unified_communications_manager
emergency_responder
unity_connection

CWE

CWE-269

Improper Privilege Management

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2023-20266", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "published": "2023-08-30T17:15:08.357", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME) y Cisco Unity Connection podr\u00eda permitir a un atacante remoto autenticado elevar los privilegios a root en un dispositivo afectado. Esta vulnerabilidad existe porque la aplicaci\u00f3n no restringe adecuadamente los archivos que se utilizan para las actualizaciones. Un atacante podr\u00eda aprovechar esta vulnerabilidad proporcionando un archivo de actualizaci\u00f3n manipulado. Un exploit exitoso podr\u00eda permitir al atacante elevar los privilegios a root. Para aprovechar esta vulnerabilidad, el atacante debe tener credenciales v\u00e1lidas de administrador de la plataforma en un dispositivo afectado."}], "lastModified": "2024-01-25T17:15:42.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:emergency_responder:12.5.1su4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45D3EAE2-997A-4EE4-A1CA-2F3864629231"}, {"criteria": "cpe:2.3:a:cisco:emergency_responder:12.5.1su8a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3ADE81D-B027-4413-B128-DAF24A0E748F"}, {"criteria": "cpe:2.3:a:cisco:emergency_responder:14su3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF848485-44D0-4354-852A-8E859E050A07"}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "0A0D0A9E-2635-441D-BE5B-C9DF92359D24"}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8:*:*:*:session_management:*:*:*", "vulnerable": true, "matchCriteriaId": "ED784326-A303-4797-AD19-23E424C5188D"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:12.5\\(1\\)su6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86884D5E-B015-447A-9834-1264315FCC50"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:12.5\\(1\\)su7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "538BCDAE-A94C-4343-B63B-5D29023707E8"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:12.5\\(1\\)su8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E89A84F3-E075-4CAF-9B3C-5F080FC37F8D"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}