4.6

CVE-2023-20064

Cisco IOS XR Software Bootloader Unauthenticated Information Disclosure Vulnerability

A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary commands within the GRUB environment that allow sensitive files to be viewed. An attacker could exploit this vulnerability by being connected to the console port of the Cisco IOS XR device when the device is power-cycled. A successful exploit could allow the attacker to view sensitive files that could be used to conduct additional attacks against the device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ios Xr Version < 7.9.1
   Cisco ≫ Asr 9000v-v2 Version - HwPlatform x64
   Cisco ≫ Asr 9001 Version - HwPlatform x64
   Cisco ≫ Asr 9006 Version - HwPlatform x64
   Cisco ≫ Asr 9010 Version - HwPlatform x64
   Cisco ≫ Asr 9901 Version - HwPlatform x64
   Cisco ≫ Asr 9902 Version - HwPlatform x64
   Cisco ≫ Asr 9903 Version - HwPlatform x64
   Cisco ≫ Asr 9904 Version - HwPlatform x64
   Cisco ≫ Asr 9906 Version - HwPlatform x64
   Cisco ≫ Asr 9910 Version - HwPlatform x64
   Cisco ≫ Asr 9912 Version - HwPlatform x64
   Cisco ≫ Asr 9922 Version - HwPlatform x64
   Cisco ≫ Ios Xrv 9000 Version -
   Cisco ≫ Ncs 1001 Version -
   Cisco ≫ Ncs 1002 Version -
   Cisco ≫ Ncs 1004 Version -
Cisco ≫ Ios Xr Version < 7.6.1
   Cisco ≫ Nc57-18dd-se Version -
   Cisco ≫ Nc57-24dd Version -
   Cisco ≫ Nc57-36h-se Version -
   Cisco ≫ Nc57-36h6d-s Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 540 Fronthaul Version -
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501-se Version -
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502-se Version -
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
   Cisco ≫ Ncs 560-4 Version -
   Cisco ≫ Ncs 560-7 Version -
   Cisco ≫ Ncs 57b1-5dse-sys Version -
   Cisco ≫ Ncs 57b1-6d24-sys Version -
   Cisco ≫ Ncs 57c1-48q6-sys Version -
   Cisco ≫ Ncs 57c3-mod-sys Version -
   Cisco ≫ Ncs 57c3-mods-sys Version -
Cisco ≫ Ios Xr Version < 7.7.1
   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
Cisco ≫ Ios Xr
   Cisco ≫ Ncs 6000 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.169
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.6 0.9 3.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Cisco PSIRT 4.6 0.9 3.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-load-infodisc-9rdOr5Fq
Vendor Advisory