CVE-2023-20254

highPriorität · verfolgen · 35EPSS 0.008 · 57. PerzentilEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.83% (57th) EPSS

CVSS 8.8 · high

Is it mine?

109 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · bewertet 2026-10-27

A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled. This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco Catalyst SD-WAN Managercisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.17.2highAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · psirt@cisco.com USAusnutzbarkeit 1.2 · Auswirkung 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-732USprimärCWE-266USCWE-285USCWE-732US

betroffene Produkte (109)

Betroffene Produkte und Versionsbereiche.

Cisco Cisco Catalyst SD-WAN Manageralle Versionencisco_csafUS
Cisco Cisco SD-WAN vManage≤ 19.2.4enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.10.1.1enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.9.3.0.12enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.6.3.1enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.4.1.1enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 18.4.303enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.6.2enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 18.4.1enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.6.3.0.47enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 17.2.5enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.9.2.3enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.4.2.2enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 18.4.0enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 17.2.7enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.1.3enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.7.1enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.4.2enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 20.6.3.2enisa_euvdEU
Cisco Cisco SD-WAN vManage≤ 19.2.3enisa_euvdEU

20 von 109 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

cisco-sa-sdwan-vman-sc-LRLfu2zCisco Catalyst SD-WAN Manager Vulnerabilities2023-09-27csaf · cisco_csafUS
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service (DoS) condition on an affected system. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisco_csaf NVD CVE.org MITRE

veröffentlicht 2023-09-27geändert 2026-06-17

verwandt (1,935)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-22960US	high7.8OT kritisch	35.5% (98th)	KEV	2022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor…
CVE-2021-23874US	high7.8OT kritisch	1.03% (63rd)	KEV	2021-02-10
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP…
CVE-2019-15752US	high7.8OT kritisch	48.6% (99th)	KEV	2019-08-28
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\ve…
CVE-2018-13374US	medium4.3OT kritisch	38.1% (99th)	KEV	2019-01-22
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials co…
CVE-2021-25646US	high8.8	99.1% (100th)	Exploit	2021-01-29
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments,…

+1930 weitere

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan