CVE-2023-20266

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-20266", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2022-10-27T18:47:50.373Z", "datePublished": "2023-08-30T16:18:42.528Z", "dateUpdated": "2025-07-01T13:45:58.935Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-01-25T16:58:35.907Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device."}], "affected": [{"vendor": "Cisco", "product": "Cisco Emergency Responder", "versions": [{"version": "12.5(1)SU4", "status": "affected"}, {"version": "12.5(1)SU8a", "status": "affected"}, {"version": "14SU3", "status": "affected"}]}, {"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"version": "12.5(1)SU6", "status": "affected"}, {"version": "12.5(1)SU7", "status": "affected"}, {"version": "12.5(1)SU8", "status": "affected"}, {"version": "14SU2", "status": "affected"}, {"version": "14SU3", "status": "affected"}]}, {"vendor": "Cisco", "product": "Cisco Unified Communications Manager", "versions": [{"version": "12.5(1)SU8", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Verification of Cryptographic Signature", "type": "cwe", "cweId": "CWE-347"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg", "name": "cisco-sa-cucm-priv-esc-D8Bky5eg"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-cucm-priv-esc-D8Bky5eg", "discovery": "INTERNAL", "defects": ["CSCwh30455", "CSCwh30442", "CSCwh29940"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:36.236Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg", "name": "cisco-sa-cucm-priv-esc-D8Bky5eg", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-01T13:45:46.201311Z", "id": "CVE-2023-20266", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T13:45:58.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg", "name": "cisco-sa-cucm-priv-esc-D8Bky5eg", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:36.236Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-20266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-01T13:45:46.201311Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T13:45:55.022Z"}}], "cna": {"source": {"defects": ["CSCwh30455", "CSCwh30442", "CSCwh29940"], "advisory": "cisco-sa-cucm-priv-esc-D8Bky5eg", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Emergency Responder", "versions": [{"status": "affected", "version": "12.5(1)SU4"}, {"status": "affected", "version": "12.5(1)SU8a"}, {"status": "affected", "version": "14SU3"}]}, {"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"status": "affected", "version": "12.5(1)SU6"}, {"status": "affected", "version": "12.5(1)SU7"}, {"status": "affected", "version": "12.5(1)SU8"}, {"status": "affected", "version": "14SU2"}, {"status": "affected", "version": "14SU3"}]}, {"vendor": "Cisco", "product": "Cisco Unified Communications Manager", "versions": [{"status": "affected", "version": "12.5(1)SU8"}]}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg", "name": "cisco-sa-cucm-priv-esc-D8Bky5eg"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-01-25T16:58:35.907Z"}}}, "cveMetadata": {"cveId": "CVE-2023-20266", "state": "PUBLISHED", "dateUpdated": "2025-07-01T13:45:58.935Z", "dateReserved": "2022-10-27T18:47:50.373Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2023-08-30T16:18:42.528Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Cisco Emergency Responder", "vendor": "Cisco", "versions": [{"status": "affected", "version": "12.5(1)SU4"}, {"status": "affected", "version": "12.5(1)SU8a"}, {"status": "affected", "version": "14SU3"}]}, {"product": "Cisco Unity Connection", "vendor": "Cisco", "versions": [{"status": "affected", "version": "12.5(1)SU6"}, {"status": "affected", "version": "12.5(1)SU7"}, {"status": "affected", "version": "12.5(1)SU8"}, {"status": "affected", "version": "14SU2"}, {"status": "affected", "version": "14SU3"}]}, {"product": "Cisco Unified Communications Manager", "vendor": "Cisco", "versions": [{"status": "affected", "version": "12.5(1)SU8"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:emergency_responder:12.5.1su4:*:*:*:*:*:*:*", "matchCriteriaId": "45D3EAE2-997A-4EE4-A1CA-2F3864629231", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:emergency_responder:12.5.1su8a:*:*:*:*:*:*:*", "matchCriteriaId": "C3ADE81D-B027-4413-B128-DAF24A0E748F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:emergency_responder:14su3:*:*:*:*:*:*:*", "matchCriteriaId": "CF848485-44D0-4354-852A-8E859E050A07", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8:*:*:*:-:*:*:*", "matchCriteriaId": "0A0D0A9E-2635-441D-BE5B-C9DF92359D24", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:12.5.1su8:*:*:*:session_management:*:*:*", "matchCriteriaId": "ED784326-A303-4797-AD19-23E424C5188D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:12.5\\(1\\)su6:*:*:*:*:*:*:*", "matchCriteriaId": "86884D5E-B015-447A-9834-1264315FCC50", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:12.5\\(1\\)su7:*:*:*:*:*:*:*", "matchCriteriaId": "538BCDAE-A94C-4343-B63B-5D29023707E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:12.5\\(1\\)su8:*:*:*:*:*:*:*", "matchCriteriaId": "E89A84F3-E075-4CAF-9B3C-5F080FC37F8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*", "matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*", "matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME) y Cisco Unity Connection podr\u00eda permitir a un atacante remoto autenticado elevar los privilegios a root en un dispositivo afectado. Esta vulnerabilidad existe porque la aplicaci\u00f3n no restringe adecuadamente los archivos que se utilizan para las actualizaciones. Un atacante podr\u00eda aprovechar esta vulnerabilidad proporcionando un archivo de actualizaci\u00f3n manipulado. Un exploit exitoso podr\u00eda permitir al atacante elevar los privilegios a root. Para aprovechar esta vulnerabilidad, el atacante debe tener credenciales v\u00e1lidas de administrador de la plataforma en un dispositivo afectado."}], "id": "CVE-2023-20266", "lastModified": "2026-06-17T05:30:11.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-20266", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-01T13:45:46.201311Z", "version": "2.0.3"}}]}, "published": "2023-08-30T17:15:08.357", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "psirt@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}