CVE-2023-20046
09.05.2023, 18:15
A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user. There are workarounds that address this vulnerability.Enginsight
| Vendor | Product | Version |
|---|---|---|
| cisco | staros | 𝑥 < 21.22.14 |
| cisco | staros | 21.23.0 ≤ 𝑥 < 21.23.31 |
| cisco | staros | 21.25.0 ≤ 𝑥 < 21.25.15 |
| cisco | staros | 21.26.0 ≤ 𝑥 < 21.26.17 |
| cisco | staros | 21.27.0 ≤ 𝑥 < 21.27.6 |
| cisco | staros | 21.28.0 ≤ 𝑥 < 21.28.3 |
| cisco | staros | 21.23.n:n |
| cisco | staros | 21.24 |
| cisco | staros | 21.27.m:m |
| cisco | staros | 21.28.m:m |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-289 - Authentication Bypass by Alternate NameThe software performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.