4.3

CVE-2023-20213

A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of the CDP process on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes CDP traffic. An attacker could exploit this vulnerability by sending crafted CDP traffic to the device. A successful exploit could cause the CDP process to crash, impacting neighbor discovery and the ability of Cisco ISE to determine the reachability of remote devices. After a crash, the CDP process must be manually restarted using the cdp enable command in interface configuration mode.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version 2.7.0 Update -
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch4
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch7
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch8
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch9
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.1 Update -
Cisco ≫ Identity Services Engine Version 3.1 Update patch1
Cisco ≫ Identity Services Engine Version 3.1 Update patch2
Cisco ≫ Identity Services Engine Version 3.1 Update patch3
Cisco ≫ Identity Services Engine Version 3.1 Update patch4
Cisco ≫ Identity Services Engine Version 3.1 Update patch5
Cisco ≫ Identity Services Engine Version 3.2 Update -
Cisco ≫ Identity Services Engine Version 3.2 Update patch1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.215
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Cisco PSIRT 4.3 2.8 1.4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-FceLP4xs
Vendor Advisory