Medium severity · published Aug 23, 2023
CVE-2023-20200
A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliances and of Cisco UCS…
6.3
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliances and of Cisco UCS 6300 Series Fabric Interconnects could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to the improper handling of specific SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Note: This vulnerability affects all supported SNMP versions. To exploit this vulnerability through SNMPv2c or earlier, an attacker must know the SNMP community string that is configured on an affected device. To exploit this vulnerability through SNMPv3, the attacker must have valid credentials for an SNMP user who is configured on the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
F4
Firepower 4112 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4115 · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4125 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4143 Firmware · Cisco
All versions, or not specified · source: NVD
F9
Firepower 9300 Firmware · Cisco
All versions, or not specified · source: NVD
U6
Ucs 6324 Fabric Interconnect Firmware · Cisco
4.1 before 4.1\(3l\); 4.2 before 4.2\(3d\) · source: NVD
U6
Ucs 6332 Fabric Interconnect Firmware · Cisco
4.1 before 4.1\(3l\); 4.2 through 4.2\(3b\) · source: NVD
U6
Ucs 6332-16up Fabric Interconnect Firmware · Cisco
4.1 before 4.1\(3l\); 4.2 before 4.2\(3b\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20200
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fp-ucsfi-snmp-dos-qtv69NAO
More from Firepower 4112 Firmware
6.7
CVE-2022-20865
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges
