CVE-2023-20236
Summary
| CVE | CVE-2023-20236 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-13 17:15:00 UTC |
| Updated | 2024-01-25 17:15:00 UTC |
| Description | A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device. |
Risk And Classification
Problem Types: CWE-345
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | 8201 | - | All | All | All |
| Hardware | Cisco | 8202 | - | All | All | All |
| Hardware | Cisco | 8208 | - | All | All | All |
| Hardware | Cisco | 8212 | - | All | All | All |
| Hardware | Cisco | 8218 | - | All | All | All |
| Hardware | Cisco | 8804 | - | All | All | All |
| Hardware | Cisco | 8808 | - | All | All | All |
| Hardware | Cisco | 8812 | - | All | All | All |
| Hardware | Cisco | 8818 | - | All | All | All |
| Hardware | Cisco | 8831 | - | All | All | All |
| Hardware | Cisco | Asr 9000 | - | All | All | All |
| Hardware | Cisco | Asr 9000v | - | All | All | All |
| Hardware | Cisco | Asr 9001 | - | All | All | All |
| Hardware | Cisco | Asr 9006 | - | All | All | All |
| Hardware | Cisco | Asr 9010 | - | All | All | All |
| Hardware | Cisco | Asr 9901 | - | All | All | All |
| Hardware | Cisco | Asr 9902 | - | All | All | All |
| Hardware | Cisco | Asr 9903 | - | All | All | All |
| Hardware | Cisco | Asr 9904 | - | All | All | All |
| Hardware | Cisco | Asr 9906 | - | All | All | All |
| Hardware | Cisco | Asr 9910 | - | All | All | All |
| Hardware | Cisco | Asr 9912 | - | All | All | All |
| Hardware | Cisco | Asr 9920 | - | All | All | All |
| Hardware | Cisco | Asr 9922 | - | All | All | All |
| Operating System | Cisco | Ios Xr | All | All | All | All |
| Hardware | Cisco | Ncs 1001 | - | All | All | All |
| Hardware | Cisco | Ncs 1002 | - | All | All | All |
| Hardware | Cisco | Ncs 1004 | - | All | All | All |
| Hardware | Cisco | Ncs 4009 | - | All | All | All |
| Hardware | Cisco | Ncs 4016 | - | All | All | All |
| Hardware | Cisco | Ncs 4201 | - | All | All | All |
| Hardware | Cisco | Ncs 4202 | - | All | All | All |
| Hardware | Cisco | Ncs 4206 | - | All | All | All |
| Hardware | Cisco | Ncs 4216 | - | All | All | All |
| Hardware | Cisco | Ncs 5001 | - | All | All | All |
| Hardware | Cisco | Ncs 5002 | - | All | All | All |
| Hardware | Cisco | Ncs 5011 | - | All | All | All |
| Hardware | Cisco | Ncs 540 | - | All | All | All |
| Hardware | Cisco | Ncs 5500 | - | All | All | All |
| Hardware | Cisco | Ncs 5501 | - | All | All | All |
| Hardware | Cisco | Ncs 5501 | se | All | All | All |
| Hardware | Cisco | Ncs 5502 | - | All | All | All |
| Hardware | Cisco | Ncs 5502 | se | All | All | All |
| Hardware | Cisco | Ncs 5504 | - | All | All | All |
| Hardware | Cisco | Ncs 5508 | - | All | All | All |
| Hardware | Cisco | Ncs 5516 | - | All | All | All |
| Hardware | Cisco | Ncs 560 | - | All | All | All |
| Hardware | Cisco | Ncs 560-4 | - | All | All | All |
| Hardware | Cisco | Ncs 560-7 | - | All | All | All |
| Hardware | Cisco | Ncs 57b1-5dse-sys | - | All | All | All |
| Hardware | Cisco | Ncs 57b1-6d24-sys | - | All | All | All |
| Hardware | Cisco | Ncs 57c1-48q6-sys | - | All | All | All |
| Hardware | Cisco | Ncs 57c3-mod-sys | - | All | All | All |
| Hardware | Cisco | Ncs 57c3-mods-sys | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco IOS XR Software iPXE Boot Signature Bypass Vulnerability | MISC | sec.cloudapps.cisco.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 317355 Cisco Internetwork Operating System (IOS) XR Software iPXE Boot Signature Bypass Vulnerability (cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB)