6.5

CVE-2023-20056

A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to cause an affected device to reload spontaneously, resulting in a DoS condition.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Wireless Lan Controller Software Version < 8.10.183.0
   Cisco ≫ Esw6300 Version-
Cisco ≫ Aironet Access Point Software Version < 17.9.0.135
   Cisco ≫ Aironet 1540 Version-
   Cisco ≫ Aironet 1542d Version-
   Cisco ≫ Aironet 1542i Version-
   Cisco ≫ Aironet 1560 Version-
   Cisco ≫ Aironet 1562d Version-
   Cisco ≫ Aironet 1562e Version-
   Cisco ≫ Aironet 1562i Version-
   Cisco ≫ Aironet 1800 Version-
   Cisco ≫ Aironet 1800i Version-
   Cisco ≫ Aironet 1810 Version-
   Cisco ≫ Aironet 1810w Version-
   Cisco ≫ Aironet 1815 Version-
   Cisco ≫ Aironet 1815i Version-
   Cisco ≫ Aironet 1815m Version-
   Cisco ≫ Aironet 1815t Version-
   Cisco ≫ Aironet 1815w Version-
   Cisco ≫ Aironet 2800 Version-
   Cisco ≫ Aironet 2800e Version-
   Cisco ≫ Aironet 2800i Version-
   Cisco ≫ Aironet 3800 Version-
   Cisco ≫ Aironet 3800e Version-
   Cisco ≫ Aironet 3800i Version-
   Cisco ≫ Aironet 3800p Version-
   Cisco ≫ Aironet 4800 Version-
   Cisco ≫ Catalyst 9100 Version-
   Cisco ≫ Catalyst 9105 Version-
   Cisco ≫ Catalyst 9105ax Version-
   Cisco ≫ Catalyst 9105axi Version-
   Cisco ≫ Catalyst 9105axw Version-
   Cisco ≫ Catalyst 9115 Version-
   Cisco ≫ Catalyst 9115 Ap Version-
   Cisco ≫ Catalyst 9115ax Version-
   Cisco ≫ Catalyst 9115axe Version-
   Cisco ≫ Catalyst 9115axi Version-
   Cisco ≫ Catalyst 9117 Version-
   Cisco ≫ Catalyst 9117 Ap Version-
   Cisco ≫ Catalyst 9117ax Version-
   Cisco ≫ Catalyst 9117axi Version-
   Cisco ≫ Catalyst 9120 Version-
   Cisco ≫ Catalyst 9120 Ap Version-
   Cisco ≫ Catalyst 9120ax Version-
   Cisco ≫ Catalyst 9120axe Version-
   Cisco ≫ Catalyst 9120axi Version-
   Cisco ≫ Catalyst 9120axp Version-
   Cisco ≫ Catalyst 9124 Version-
   Cisco ≫ Catalyst 9124ax Version-
   Cisco ≫ Catalyst 9124axd Version-
   Cisco ≫ Catalyst 9124axi Version-
   Cisco ≫ Catalyst 9130 Version-
   Cisco ≫ Catalyst 9130 Ap Version-
   Cisco ≫ Catalyst 9130ax Version-
   Cisco ≫ Catalyst 9130axe Version-
   Cisco ≫ Catalyst 9130axi Version-
   Cisco ≫ Catalyst Iw6300 Version-
   Cisco ≫ Catalyst Iw6300 Ac Version-
   Cisco ≫ Catalyst Iw6300 Dc Version-
   Cisco ≫ Catalyst Iw6300 Dcw Version-
Cisco ≫ Ios Xe Version < 16.12.8
Cisco ≫ Ios Xe Version >= 17.1 < 17.3.6
Cisco ≫ Ios Xe Version >= 17.4 < 17.6.5
Cisco ≫ Ios Xe Version >= 17.7 < 17.9.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.165
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
psirt@cisco.com 6.5 2 4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.