CVE-2023-20115
23.08.2023, 19:15
A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attacker to download or overwrite files from the underlying operating system of an affected device. This vulnerability is due to a logic error when verifying the user role when an SFTP connection is opened to an affected device. An attacker could exploit this vulnerability by connecting and authenticating via SFTP as a valid, non-administrator user. A successful exploit could allow the attacker to read or overwrite files from the underlying operating system with the privileges of the authenticated user. There are workarounds that address this vulnerability.Enginsight
| Vendor | Product | Version |
|---|---|---|
| cisco | nx-os | 9.2\(1\) |
| cisco | nx-os | 9.2\(2\) |
| cisco | nx-os | 9.2\(2t\) |
| cisco | nx-os | 9.2\(2v\) |
| cisco | nx-os | 9.2\(3\) |
| cisco | nx-os | 9.2\(4\) |
| cisco | nx-os | 9.3\(1\) |
| cisco | nx-os | 9.3\(2\) |
| cisco | nx-os | 9.3\(3\) |
| cisco | nx-os | 9.3\(4\) |
| cisco | nx-os | 9.3\(5\) |
| cisco | nx-os | 9.3\(6\) |
| cisco | nx-os | 9.3\(7\) |
| cisco | nx-os | 9.3\(7a\) |
| cisco | nx-os | 9.3\(8\) |
| cisco | nx-os | 9.3\(9\) |
| cisco | nx-os | 9.3\(10\) |
| cisco | nx-os | 9.3\(11\) |
| cisco | nx-os | 10.1\(1\) |
| cisco | nx-os | 10.1\(2\) |
| cisco | nx-os | 10.1\(2t\) |
| cisco | nx-os | 10.2\(1\) |
| cisco | nx-os | 10.2\(1q\) |
| cisco | nx-os | 10.2\(2\) |
| cisco | nx-os | 10.2\(3\) |
| cisco | nx-os | 10.2\(3t\) |
| cisco | nx-os | 10.2\(4\) |
| cisco | nx-os | 10.2\(5\) |
| cisco | nx-os | 10.3\(1\) |
| cisco | nx-os | 10.3\(2\) |
𝑥
= Vulnerable software versions