CVE-2023-20236

Published Sep 13, 2023 CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.

This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco IOS XR Software

affected

Version	Status	Constraints
`5.2.0`	affected	—
`5.2.1`	affected	—
`5.2.2`	affected	—
`5.2.4`	affected	—
`5.2.3`	affected	—
`5.2.5`	affected	—
`5.2.47`	affected	—
`5.3.0`	affected	—
`5.3.1`	affected	—
`5.3.2`	affected	—
`5.3.3`	affected	—
`5.3.4`	affected	—
`6.0.0`	affected	—
`6.0.1`	affected	—
`6.0.2`	affected	—
`6.1.1`	affected	—
`6.1.2`	affected	—
`6.1.3`	affected	—
`6.1.4`	affected	—
`6.1.12`	affected	—
`6.1.22`	affected	—
`6.1.32`	affected	—
`6.1.36`	affected	—
`6.1.42`	affected	—
`6.2.1`	affected	—
`6.2.2`	affected	—
`6.2.3`	affected	—
`6.2.25`	affected	—
`6.2.11`	affected	—
`6.3.2`	affected	—
`6.3.3`	affected	—
`6.3.15`	affected	—
`6.4.1`	affected	—
`6.4.2`	affected	—
`6.4.3`	affected	—
`6.5.1`	affected	—
`6.5.2`	affected	—
`6.5.3`	affected	—
`6.5.25`	affected	—
`6.5.26`	affected	—
`6.5.28`	affected	—
`6.5.29`	affected	—
`6.5.32`	affected	—
`6.5.33`	affected	—
`6.6.2`	affected	—
`6.6.3`	affected	—
`6.6.25`	affected	—
`6.6.4`	affected	—
`7.0.1`	affected	—
`7.0.2`	affected	—
`7.0.12`	affected	—
`7.0.14`	affected	—
`7.1.1`	affected	—
`7.1.15`	affected	—
`7.1.2`	affected	—
`7.1.3`	affected	—
`6.7.1`	affected	—
`6.7.2`	affected	—
`6.7.3`	affected	—
`6.7.4`	affected	—
`7.2.0`	affected	—
`7.2.1`	affected	—
`7.2.2`	affected	—
`7.3.1`	affected	—
`7.3.15`	affected	—
`7.3.2`	affected	—
`7.3.3`	affected	—
`7.3.5`	affected	—
`7.4.1`	affected	—
`7.4.2`	affected	—
`6.8.1`	affected	—
`6.8.2`	affected	—
`7.5.1`	affected	—
`7.5.3`	affected	—
`7.5.2`	affected	—
`7.5.4`	affected	—
`7.6.1`	affected	—
`7.6.2`	affected	—
`7.7.1`	affected	—
`7.7.2`	affected	—
`7.7.21`	affected	—
`6.9.1`	affected	—
`6.9.2`	affected	—
`7.8.1`	affected	—
`7.8.2`	affected	—
`7.9.1`	affected	—
`7.9.2`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:8201:-:::::::*
	cpe:2.3:h:cisco:8202:-:::::::*
	cpe:2.3:h:cisco:8208:-:::::::*
	cpe:2.3:h:cisco:8212:-:::::::*
	cpe:2.3:h:cisco:8218:-:::::::*
	cpe:2.3:h:cisco:8804:-:::::::*
	cpe:2.3:h:cisco:8808:-:::::::*
	cpe:2.3:h:cisco:8812:-:::::::*
	cpe:2.3:h:cisco:8818:-:::::::*
	cpe:2.3:h:cisco:8831:-:::::::*
	cpe:2.3:h:cisco:asr_9000:-:::::::*
	cpe:2.3:h:cisco:asr_9000v:-:::::::*
	cpe:2.3:h:cisco:asr_9001:-:::::::*
	cpe:2.3:h:cisco:asr_9006:-:::::::*
	cpe:2.3:h:cisco:asr_9010:-:::::::*
	cpe:2.3:h:cisco:asr_9901:-:::::::*
	cpe:2.3:h:cisco:asr_9902:-:::::::*
	cpe:2.3:h:cisco:asr_9903:-:::::::*
	cpe:2.3:h:cisco:asr_9904:-:::::::*
	cpe:2.3:h:cisco:asr_9906:-:::::::*
	cpe:2.3:h:cisco:asr_9910:-:::::::*
	cpe:2.3:h:cisco:asr_9912:-:::::::*
	cpe:2.3:h:cisco:asr_9920:-:::::::*
	cpe:2.3:h:cisco:asr_9922:-:::::::*
	cpe:2.3:h:cisco:ncs_1001:-:::::::*
	cpe:2.3:h:cisco:ncs_1002:-:::::::*
	cpe:2.3:h:cisco:ncs_1004:-:::::::*
	cpe:2.3:h:cisco:ncs_4009:-:::::::*
	cpe:2.3:h:cisco:ncs_4016:-:::::::*
	cpe:2.3:h:cisco:ncs_4201:-:::::::*
	cpe:2.3:h:cisco:ncs_4202:-:::::::*
	cpe:2.3:h:cisco:ncs_4206:-:::::::*
	cpe:2.3:h:cisco:ncs_4216:-:::::::*
	cpe:2.3:h:cisco:ncs_5001:-:::::::*
	cpe:2.3:h:cisco:ncs_5002:-:::::::*
	cpe:2.3:h:cisco:ncs_5011:-:::::::*
	cpe:2.3:h:cisco:ncs_540:-:::::::*
	cpe:2.3:h:cisco:ncs_5500:-:::::::*
	cpe:2.3:h:cisco:ncs_5501:-:::::::*
	cpe:2.3:h:cisco:ncs_5501:se:::::::*
	cpe:2.3:h:cisco:ncs_5502:-:::::::*
	cpe:2.3:h:cisco:ncs_5502:se:::::::*
	cpe:2.3:h:cisco:ncs_5504:-:::::::*
	cpe:2.3:h:cisco:ncs_5508:-:::::::*
	cpe:2.3:h:cisco:ncs_5516:-:::::::*
	cpe:2.3:h:cisco:ncs_560:-:::::::*
	cpe:2.3:h:cisco:ncs_560-4:-:::::::*
	cpe:2.3:h:cisco:ncs_560-7:-:::::::*
	cpe:2.3:h:cisco:ncs_57b1-5dse-sys:-:::::::*
	cpe:2.3:h:cisco:ncs_57b1-6d24-sys:-:::::::*
	cpe:2.3:h:cisco:ncs_57c1-48q6-sys:-:::::::*
	cpe:2.3:h:cisco:ncs_57c3-mod-sys:-:::::::*
	cpe:2.3:h:cisco:ncs_57c3-mods-sys:-:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-24415	A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.100% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB

History

Dec 17, 2025 5:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 23, 2024 7:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Cisco ios Xr Software
CPEs		cpe:2.3:o:cisco:ios_xr_software::::::::
Vendors & Products		Cisco ios Xr Software
Metrics		ssvc `{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}`

Subscriptions

Cisco 8201 8202 8208 8212 8218 8804 8808 8812 8818 8831 Asr 9000 Asr 9000v Asr 9001 Asr 9006 Asr 9010 Asr 9901 Asr 9902 Asr 9903 Asr 9904 Asr 9906 Asr 9910 Asr 9912 Asr 9920 Asr 9922 Ios Xr Ios Xr Software Ncs 1001 Ncs 1002 Ncs 1004 Ncs 4009 Ncs 4016 Ncs 4201 Ncs 4202 Ncs 4206 Ncs 4216 Ncs 5001 Ncs 5002 Ncs 5011 Ncs 540 Ncs 5500 Ncs 5501 Ncs 5502 Ncs 5504 Ncs 5508 Ncs 5516 Ncs 560 Ncs 560-4 Ncs 560-7 Ncs 57b1-5dse-sys Ncs 57b1-6d24-sys Ncs 57c1-48q6-sys Ncs 57c3-mod-sys Ncs 57c3-mods-sys

Weaknesses