CVE-2023-20024
high-risk
Published 2023-05-18
Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
Do I need to act?
-
0.98% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10
High
NETWORK
/ LOW complexity
Affected Products (20)
Business 250-16P-2G Firmware
Business 250-16T-2G Firmware
Business 250-24Fp-4G Firmware
Business 250-24Fp-4X Firmware
Business 250-24P-4G Firmware
Business 250-24P-4X Firmware
Business 250-24Pp-4G Firmware
Business 250-24T-4G Firmware
Business 250-24T-4X Firmware
Business 250-48P-4G Firmware
Business 250-48P-4X Firmware
Business 250-48Pp-4G Firmware
Business 250-48T-4G Firmware
Business 250-48T-4X Firmware
Business 250-8Fp-E-2G Firmware
Business 250-8P-E-2G Firmware
Business 250-8Pp-D Firmware
Business 250-8Pp-E-2G Firmware
Business 250-8T-D Firmware
Business 250-8T-E-2G Firmware
Affected Vendors
References (2)
65
/ 100
high-risk
Severity
29/34 · Critical
Exploitability
3/34 · Minimal
Exposure
33/34 · Critical