CVE Feed

    Dashboard / CVE / CVE-2023-20115

    CVE-2023-20115

    A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attacker to download or overwrite files from the underlying operating system of an affected device. This vulnerability is due to a logic error when verifying the user role when an SFTP connection is opened to an affected device. An attacker could exploit this vulnerability by connecting and authenticating via SFTP as a valid, non-administrator user. A successful exploit could allow the attacker to read or overwrite files from the underlying operating system with the privileges of the authenticated user. There are workarounds that address this vulnerability.

    Published:Aug 23, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 23, 2023
    EPSS Score:0.00308
    CVSS Score:5.4

    Affected Products

    Vendor
    Cisco
    Product
    Nexus 3048
    Vendor
    Cisco
    Product
    Nexus 31108pc-v
    Vendor
    Cisco
    Product
    Nexus 31108tc-v
    Vendor
    Cisco
    Product
    Nexus 31128pq
    Vendor
    Cisco
    Product
    Nexus 3132c-z
    Vendor
    Cisco
    Product
    Nexus 3132q-v
    Vendor
    Cisco
    Product
    Nexus 3132q-xl
    Vendor
    Cisco
    Product
    Nexus 3164q
    Vendor
    Cisco
    Product
    Nexus 3172pq
    Vendor
    Cisco
    Product
    Nexus 3172pq-xl
    Vendor
    Cisco
    Product
    Nexus 3172tq
    Vendor
    Cisco
    Product
    Nexus 3172tq-32t
    Vendor
    Cisco
    Product
    Nexus 3172tq-xl
    Vendor
    Cisco
    Product
    Nexus 3232c
    Vendor
    Cisco
    Product
    Nexus 3264c-e
    Vendor
    Cisco
    Product
    Nexus 3264q
    Vendor
    Cisco
    Product
    Nexus 3408-s
    Vendor
    Cisco
    Product
    Nexus 34180yc
    Vendor
    Cisco
    Product
    Nexus 34200yc-sm
    Vendor
    Cisco
    Product
    Nexus 3432d-s
    Vendor
    Cisco
    Product
    Nexus 3464c
    Vendor
    Cisco
    Product
    Nexus 3524
    Vendor
    Cisco
    Product
    Nexus 3524-x
    Vendor
    Cisco
    Product
    Nexus 3524-xl
    Vendor
    Cisco
    Product
    Nexus 3548
    Vendor
    Cisco
    Product
    Nexus 3548-x
    Vendor
    Cisco
    Product
    Nexus 3548-xl
    Vendor
    Cisco
    Product
    Nexus 36180yc-r
    Vendor
    Cisco
    Product
    Nexus 3636c-r
    Vendor
    Cisco
    Product
    Nexus 9000v
    Vendor
    Cisco
    Product
    Nexus 92160yc-x
    Vendor
    Cisco
    Product
    Nexus 92300yc
    Vendor
    Cisco
    Product
    Nexus 92304qc
    Vendor
    Cisco
    Product
    Nexus 9232e
    Vendor
    Cisco
    Product
    Nexus 92348gc-x
    Vendor
    Cisco
    Product
    Nexus 9236c
    Vendor
    Cisco
    Product
    Nexus 9272q
    Vendor
    Cisco
    Product
    Nexus 93108tc-ex
    Vendor
    Cisco
    Product
    Nexus 93108tc-ex-24
    Vendor
    Cisco
    Product
    Nexus 93108tc-fx
    Vendor
    Cisco
    Product
    Nexus 93108tc-fx-24
    Vendor
    Cisco
    Product
    Nexus 93108tc-fx3h
    Vendor
    Cisco
    Product
    Nexus 93108tc-fx3p
    Vendor
    Cisco
    Product
    Nexus 93120tx
    Vendor
    Cisco
    Product
    Nexus 93128tx
    Vendor
    Cisco
    Product
    Nexus 9316d-gx
    Vendor
    Cisco
    Product
    Nexus 93180lc-ex
    Vendor
    Cisco
    Product
    Nexus 93180yc-ex
    Vendor
    Cisco
    Product
    Nexus 93180yc-ex-24
    Vendor
    Cisco
    Product
    Nexus 93180yc-fx
    Vendor
    Cisco
    Product
    Nexus 93180yc-fx-24
    Vendor
    Cisco
    Product
    Nexus 93180yc-fx3
    Vendor
    Cisco
    Product
    Nexus 93180yc-fx3h
    Vendor
    Cisco
    Product
    Nexus 93180yc-fx3s
    Vendor
    Cisco
    Product
    Nexus 93216tc-fx2
    Vendor
    Cisco
    Product
    Nexus 93240yc-fx2
    Vendor
    Cisco
    Product
    Nexus 9332c
    Vendor
    Cisco
    Product
    Nexus 9332d-gx2b
    Vendor
    Cisco
    Product
    Nexus 9332d-h2r
    Vendor
    Cisco
    Product
    Nexus 9332pq
    Vendor
    Cisco
    Product
    Nexus 93360yc-fx2
    Vendor
    Cisco
    Product
    Nexus 9336c-fx2
    Vendor
    Cisco
    Product
    Nexus 9336c-fx2-e
    Vendor
    Cisco
    Product
    Nexus 9336pq Aci Spine
    Vendor
    Cisco
    Product
    Nexus 9348d-gx2a
    Vendor
    Cisco
    Product
    Nexus 9348gc-fx3
    Vendor
    Cisco
    Product
    Nexus 9348gc-fxp
    Vendor
    Cisco
    Product
    Nexus 93600cd-gx
    Vendor
    Cisco
    Product
    Nexus 9364c
    Vendor
    Cisco
    Product
    Nexus 9364c-gx
    Vendor
    Cisco
    Product
    Nexus 9364d-gx2a
    Vendor
    Cisco
    Product
    Nexus 9372px
    Vendor
    Cisco
    Product
    Nexus 9372px-e
    Vendor
    Cisco
    Product
    Nexus 9372tx
    Vendor
    Cisco
    Product
    Nexus 9372tx-e
    Vendor
    Cisco
    Product
    Nexus 9396px
    Vendor
    Cisco
    Product
    Nexus 9396tx
    Vendor
    Cisco
    Product
    Nexus 9408
    Vendor
    Cisco
    Product
    Nexus 9508
    Vendor
    Cisco
    Product
    Nexus 9804
    Vendor
    Cisco
    Product
    Nexus 9808
    Vendor
    Cisco
    Product
    Nx-os

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-20284 (CVSS 5.3) — A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged…
    CVE-2024-20285 (CVSS 5.3) — A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged…
    CVE-2024-20286 (CVSS 5.3) — A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged…
    CVE-2024-20399 (CVSS 6) — A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administ…
    CVE-2024-20294 (CVSS 6.6) — A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Sof…
    CVE-2024-20291 (CVSS 5.8) — A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 300…
    CVE-2023-44487 (CVSS 7.5) — The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can …
    CVE-2023-20169 (CVSS 7.4) — A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for…
    CVE-2023-20168 (CVSS 7.1) — A vulnerability in TACACS+ and RADIUS remote authentication for Cisco NX-OS Software could allow an unauthenti…
    CVE-2023-20050 (CVSS 4.4) — A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arb…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High