CVE-2023-20135

HIGH Year: 2023
CVSS v3 Score
7.0
High
Weakness Type
CWE-347
View all →

Vulnerability Description

A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. This vulnerability is due to a time-of-check, time-of-use (TOCTOU) race condition when an install query regarding an ISO image is performed during an install operation that uses an ISO image. An attacker could exploit this vulnerability by modifying an ISO image and then carrying out install requests in parallel. A successful exploit could allow the attacker to execute arbitrary code on an affected device.

Related Vulnerabilities

CVE-2020-14365

HIGH
CVSS:7.1(High)

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during i...

CWE-3472020

CVE-2020-25166

HIGH
CVSS:7.1(High)

An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allo...

CWE-3472020

CVE-2023-23431

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.

CWE-3472023

CVE-2023-23432

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.

CWE-3472023

CVE-2023-23433

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.

CWE-3472023