CVE-2023-20046

Published May 9, 2023 CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Description

A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.

This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user.

There are workarounds that address this vulnerability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco ASR 5000 Series Software

affected

Version	Status	Constraints
`21.11.0`	affected	—
`21.11.1`	affected	—
`21.11.2`	affected	—
`21.11.3`	affected	—
`21.11.10`	affected	—
`21.11.11`	affected	—
`21.11.12`	affected	—
`21.11.13`	affected	—
`21.11.14`	affected	—
`21.11.4`	affected	—
`21.11.5`	affected	—
`21.11.6`	affected	—
`21.11.7`	affected	—
`21.11.8`	affected	—
`21.11.9`	affected	—
`21.11.15`	affected	—
`21.11.16`	affected	—
`21.11.17`	affected	—
`21.11.18`	affected	—
`21.11.19`	affected	—
`21.11.20`	affected	—
`21.11.21`	affected	—
`21.12.0`	affected	—
`21.12.1`	affected	—
`21.12.2`	affected	—
`21.12.3`	affected	—
`21.12.4`	affected	—
`21.12.5`	affected	—
`21.12.6`	affected	—
`21.12.10`	affected	—
`21.12.11`	affected	—
`21.12.12`	affected	—
`21.12.13`	affected	—
`21.12.14`	affected	—
`21.12.16`	affected	—
`21.12.17`	affected	—
`21.12.18`	affected	—
`21.12.7`	affected	—
`21.12.8`	affected	—
`21.12.9`	affected	—
`21.12.19`	affected	—
`21.12.20`	affected	—
`21.12.21`	affected	—
`21.12.22`	affected	—
`21.12.15`	affected	—
`21.13.0`	affected	—
`21.13.1`	affected	—
`21.13.2`	affected	—
`21.13.3`	affected	—
`21.13.4`	affected	—
`21.13.10`	affected	—
`21.13.11`	affected	—
`21.13.12`	affected	—
`21.13.13`	affected	—
`21.13.14`	affected	—
`21.13.15`	affected	—
`21.13.16`	affected	—
`21.13.17`	affected	—
`21.13.18`	affected	—
`21.13.19`	affected	—
`21.13.20`	affected	—
`21.13.5`	affected	—
`21.13.6`	affected	—
`21.13.7`	affected	—
`21.13.8`	affected	—
`21.13.9`	affected	—
`21.13.21`	affected	—
`21.14.0`	affected	—
`21.14.1`	affected	—
`21.14.10`	affected	—
`21.14.11`	affected	—
`21.14.12`	affected	—
`21.14.16`	affected	—
`21.14.17`	affected	—
`21.14.19`	affected	—
`21.14.2`	affected	—
`21.14.20`	affected	—
`21.14.3`	affected	—
`21.14.4`	affected	—
`21.14.5`	affected	—
`21.14.6`	affected	—
`21.14.7`	affected	—
`21.14.8`	affected	—
`21.14.9`	affected	—
`21.14.b12`	affected	—
`21.14.b13`	affected	—
`21.14.b14`	affected	—
`21.14.b15`	affected	—
`21.14.b17`	affected	—
`21.14.b18`	affected	—
`21.14.b19`	affected	—
`21.14.b20`	affected	—
`21.14.b21`	affected	—
`21.14.22`	affected	—
`21.14.b22`	affected	—
`21.14.23`	affected	—
`21.15.0`	affected	—
`21.15.1`	affected	—
`21.15.10`	affected	—
`21.15.11`	affected	—
`21.15.12`	affected	—
`21.15.13`	affected	—
`21.15.14`	affected	—
`21.15.15`	affected	—
`21.15.16`	affected	—
`21.15.17`	affected	—
`21.15.18`	affected	—
`21.15.19`	affected	—
`21.15.2`	affected	—
`21.15.20`	affected	—
`21.15.21`	affected	—
`21.15.22`	affected	—
`21.15.24`	affected	—
`21.15.25`	affected	—
`21.15.26`	affected	—
`21.15.27`	affected	—
`21.15.28`	affected	—
`21.15.29`	affected	—
`21.15.3`	affected	—
`21.15.30`	affected	—
`21.15.32`	affected	—
`21.15.33`	affected	—
`21.15.36`	affected	—
`21.15.37`	affected	—
`21.15.39`	affected	—
`21.15.4`	affected	—
`21.15.40`	affected	—
`21.15.41`	affected	—
`21.15.5`	affected	—
`21.15.6`	affected	—
`21.15.7`	affected	—
`21.15.8`	affected	—
`21.15.43`	affected	—
`21.15.45`	affected	—
`21.15.46`	affected	—
`21.15.47`	affected	—
`21.15.48`	affected	—
`21.15.51`	affected	—
`21.15.52`	affected	—
`21.15.53`	affected	—
`21.15.54`	affected	—
`21.15.55`	affected	—
`21.15.57`	affected	—
`21.15.58`	affected	—
`21.15.59`	affected	—
`21.15.60`	affected	—
`21.16.2`	affected	—
`21.16.3`	affected	—
`21.16.4`	affected	—
`21.16.5`	affected	—
`21.16.c10`	affected	—
`21.16.c11`	affected	—
`21.16.c12`	affected	—
`21.16.c13`	affected	—
`21.16.c9`	affected	—
`21.16.d0`	affected	—
`21.16.d1`	affected	—
`21.16.6`	affected	—
`21.16.c14`	affected	—
`21.16.7`	affected	—
`21.16.c15`	affected	—
`21.16.8`	affected	—
`21.16.c16`	affected	—
`21.16.10`	affected	—
`21.16.9`	affected	—
`21.16.c17`	affected	—
`21.16.c18`	affected	—
`21.16.c19`	affected	—
`21.17.0`	affected	—
`21.17.1`	affected	—
`21.17.2`	affected	—
`21.17.3`	affected	—
`21.17.4`	affected	—
`21.17.5`	affected	—
`21.17.6`	affected	—
`21.17.7`	affected	—
`21.17.8`	affected	—
`21.17.10`	affected	—
`21.17.11`	affected	—
`21.17.9`	affected	—
`21.17.12`	affected	—
`21.17.13`	affected	—
`21.17.14`	affected	—
`21.17.15`	affected	—
`21.17.16`	affected	—
`21.17.17`	affected	—
`21.17.18`	affected	—
`21.17.19`	affected	—
`21.18.0`	affected	—
`21.18.1`	affected	—
`21.18.2`	affected	—
`21.18.3`	affected	—
`21.18.4`	affected	—
`21.18.5`	affected	—
`21.18.11`	affected	—
`21.18.6`	affected	—
`21.18.7`	affected	—
`21.18.8`	affected	—
`21.18.9`	affected	—
`21.18.12`	affected	—
`21.18.13`	affected	—
`21.18.14`	affected	—
`21.18.15`	affected	—
`21.18.16`	affected	—
`21.18.17`	affected	—
`21.18.18`	affected	—
`21.18.19`	affected	—
`21.18.20`	affected	—
`21.18.21`	affected	—
`21.18.22`	affected	—
`21.18.23`	affected	—
`21.18.24`	affected	—
`21.18.25`	affected	—
`21.18.26`	affected	—
`21.19.0`	affected	—
`21.19.1`	affected	—
`21.19.2`	affected	—
`21.19.3`	affected	—
`21.19.n2`	affected	—
`21.19.4`	affected	—
`21.19.5`	affected	—
`21.19.n3`	affected	—
`21.19.n4`	affected	—
`21.19.6`	affected	—
`21.19.7`	affected	—
`21.19.8`	affected	—
`21.19.n5`	affected	—
`21.19.10`	affected	—
`21.19.9`	affected	—
`21.19.n6`	affected	—
`21.19.n7`	affected	—
`21.19.n8`	affected	—
`21.19.11`	affected	—
`21.19.n10`	affected	—
`21.19.n11`	affected	—
`21.19.n12`	affected	—
`21.19.n13`	affected	—
`21.19.n14`	affected	—
`21.19.n15`	affected	—
`21.19.n16`	affected	—
`21.19.n9`	affected	—
`21.19.n17`	affected	—
`21.19.n18`	affected	—
`21.20.0`	affected	—
`21.20.1`	affected	—
`21.20.SV1`	affected	—
`21.20.SV3`	affected	—
`21.20.SV5`	affected	—
`21.20.2`	affected	—
`21.20.3`	affected	—
`21.20.4`	affected	—
`21.20.5`	affected	—
`21.20.6`	affected	—
`21.20.7`	affected	—
`21.20.8`	affected	—
`21.20.9`	affected	—
`21.20.k6`	affected	—
`21.20.10`	affected	—
`21.20.11`	affected	—
`21.20.k7`	affected	—
`21.20.u8`	affected	—
`21.20.12`	affected	—
`21.20.13`	affected	—
`21.20.14`	affected	—
`21.20.k8`	affected	—
`21.20.p9`	affected	—
`21.20.15`	affected	—
`21.20.16`	affected	—
`21.20.17`	affected	—
`21.20.18`	affected	—
`21.20.19`	affected	—
`21.20.20`	affected	—
`21.20.21`	affected	—
`21.20.22`	affected	—
`21.20.23`	affected	—
`21.20.24`	affected	—
`21.20.25`	affected	—
`21.20.26`	affected	—
`21.20.28`	affected	—
`21.20.29`	affected	—
`21.20.30`	affected	—
`21.20.c22`	affected	—
`21.20.31`	affected	—
`21.20.32`	affected	—
`21.20.33`	affected	—
`21.20.34`	affected	—
`21.20.35`	affected	—
`21.20.27`	affected	—
`21.20.SV2`	affected	—
`21.21.0`	affected	—
`21.21.1`	affected	—
`21.21.2`	affected	—
`21.21.3`	affected	—
`21.21.KS2`	affected	—
`21.22.0`	affected	—
`21.22.n2`	affected	—
`21.22.n3`	affected	—
`21.22.3`	affected	—
`21.22.4`	affected	—
`21.22.5`	affected	—
`21.22.uj3`	affected	—
`21.22.11`	affected	—
`21.22.6`	affected	—
`21.22.7`	affected	—
`21.22.8`	affected	—
`21.22.n4`	affected	—
`21.22.n5`	affected	—
`21.22.ua0`	affected	—
`21.22.ua2`	affected	—
`21.22.ua3`	affected	—
`21.22.ua5`	affected	—
`21.22.12`	affected	—
`21.22.13`	affected	—
`21.22.n10`	affected	—
`21.22.n11`	affected	—
`21.22.n12`	affected	—
`21.22.n6`	affected	—
`21.22.n7`	affected	—
`21.22.n8`	affected	—
`21.22.n9`	affected	—
`21.22.n13`	affected	—
`21.23.0`	affected	—
`21.23.1`	affected	—
`21.23.10`	affected	—
`21.23.11`	affected	—
`21.23.12`	affected	—
`21.23.13`	affected	—
`21.23.14`	affected	—
`21.23.15`	affected	—
`21.23.16`	affected	—
`21.23.17`	affected	—
`21.23.2`	affected	—
`21.23.3`	affected	—
`21.23.4`	affected	—
`21.23.5`	affected	—
`21.23.6`	affected	—
`21.23.7`	affected	—
`21.23.8`	affected	—
`21.23.9`	affected	—
`21.23.b2`	affected	—
`21.23.b3`	affected	—
`21.23.c16`	affected	—
`21.23.c17`	affected	—
`21.23.n6`	affected	—
`21.23.n7`	affected	—
`21.23.n9`	affected	—
`21.23.18`	affected	—
`21.23.19`	affected	—
`21.23.21`	affected	—
`21.23.22`	affected	—
`21.23.23`	affected	—
`21.23.24`	affected	—
`21.23.25`	affected	—
`21.23.26`	affected	—
`21.23.27`	affected	—
`21.23.29`	affected	—
`21.23.30`	affected	—
`21.23.c18`	affected	—
`21.23.n10`	affected	—
`21.23.n11`	affected	—
`21.23.n8`	affected	—
`21.23.yn14`	affected	—
`21.24.0`	affected	—
`21.24.1`	affected	—
`21.24.2`	affected	—
`21.24.3`	affected	—
`21.25.0`	affected	—
`21.25.3`	affected	—
`21.25.4`	affected	—
`21.25.5`	affected	—
`21.25.10`	affected	—
`21.25.11`	affected	—
`21.25.12`	affected	—
`21.25.13`	affected	—
`21.25.14`	affected	—
`21.25.6`	affected	—
`21.25.7`	affected	—
`21.25.8`	affected	—
`21.25.9`	affected	—
`21.26.0`	affected	—
`21.26.1`	affected	—
`21.26.10`	affected	—
`21.26.13`	affected	—
`21.26.14`	affected	—
`21.26.15`	affected	—
`21.26.3`	affected	—
`21.26.5`	affected	—
`21.26.6`	affected	—
`21.26.7`	affected	—
`21.26.17`	affected	—
`21.27.0`	affected	—
`21.27.1`	affected	—
`21.27.2`	affected	—
`21.27.3`	affected	—
`21.27.4`	affected	—
`21.27.5`	affected	—
`21.27.m0`	affected	—
`21.28.0`	affected	—
`21.28.1`	affected	—
`21.28.2`	affected	—
`21.28.m0`	affected	—
`21.28.m1`	affected	—
`21.28.m2`	affected	—
`21.28.m3`	affected	—

Cisco

Cisco Ultra Cloud Core - User Plane Function

affected

Version	Status	Constraints
`N/A`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:cisco:staros::::::::
	cpe:2.3:o:cisco:staros::::::::
	cpe:2.3:o:cisco:staros::::::::
	cpe:2.3:o:cisco:staros::::::::
	cpe:2.3:o:cisco:staros::::::::
	cpe:2.3:o:cisco:staros::::::::
	cpe:2.3:o:cisco:staros:21.23.n:::::::*
	cpe:2.3:o:cisco:staros:21.24:::::::*
	cpe:2.3:o:cisco:staros:21.27.m:::::::*
	cpe:2.3:o:cisco:staros:21.28.m:::::::*

OR	cpe:2.3:h:cisco:asr_5000:-:::::::*
	cpe:2.3:h:cisco:asr_5500:-:::::::*
	cpe:2.3:h:cisco:asr_5700:-:::::::*
	cpe:2.3:h:cisco:vpc-di:-:::::::*
	cpe:2.3:h:cisco:vpc-si:-:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-24225	A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user. There are workarounds that address this vulnerability.