BDU:2023-01848

Опубликовано: 22 мар. 2023

Источник: fstec

CVSS3: 8.6

CVSS2: 7.8

EPSS Низкий

Описание

Уязвимость реализации протокола DHCPv6 операционных систем Cisco IOS XE и Cisco IOS связана с непроверенным индексированием массива. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать перезагрузку устройства или вызвать отказ в обслуживании в результате отправки специально созданных сообщений DHCPv6

Вендор

Cisco Systems Inc.

Наименование ПО

Cisco IOS

Cisco IOS XE

Версия ПО

15.3s (Cisco IOS)

16.1 (Cisco IOS XE)

16.2 (Cisco IOS XE)

3.9S (Cisco IOS XE)

3.3XO (Cisco IOS XE)

16.3 (Cisco IOS XE)

3.7E (Cisco IOS XE)

3.8E (Cisco IOS XE)

3.9E (Cisco IOS XE)

3.10S (Cisco IOS XE)

3.15S (Cisco IOS XE)

3.16S (Cisco IOS XE)

3.17S (Cisco IOS XE)

16.4 (Cisco IOS XE)

16.5 (Cisco IOS XE)

16.6 (Cisco IOS XE)

16.7 (Cisco IOS XE)

16.8 (Cisco IOS XE)

16.9 (Cisco IOS XE)

16.10 (Cisco IOS XE)

16.11 (Cisco IOS XE)

17.2 (Cisco IOS XE)

17.3 (Cisco IOS XE)

3.7S (Cisco IOS XE)

3.8S (Cisco IOS XE)

3.4SG (Cisco IOS XE)

3.5E (Cisco IOS XE)

3.11S (Cisco IOS XE)

3.12S (Cisco IOS XE)

3.13S (Cisco IOS XE)

3.6E (Cisco IOS XE)

3.14S (Cisco IOS XE)

3.18S (Cisco IOS XE)

3.18SP (Cisco IOS XE)

3.10E (Cisco IOS XE)

15.2S (Cisco IOS)

15.1SY (Cisco IOS)

15.4S (Cisco IOS)

15.2SC (Cisco IOS)

15.5S (Cisco IOS)

15.3SY (Cisco IOS)

15.6SP (Cisco IOS)

15.4SY (Cisco IOS)

15.5SY (Cisco IOS)

15.7M (Cisco IOS)

15.8M (Cisco IOS)

15.3T (Cisco IOS)

15.1M (Cisco IOS)

15.2M (Cisco IOS)

15.2GC (Cisco IOS)

15.4T (Cisco IOS)

15.4M (Cisco IOS)

15.4CG (Cisco IOS)

15.4SN (Cisco IOS)

15.5M (Cisco IOS)

15.5SN (Cisco IOS)

15.6S (Cisco IOS)

15.6T (Cisco IOS)

15.5XB (Cisco IOS)

15.6SN (Cisco IOS)

15.6M (Cisco IOS)

15.1SG (Cisco IOS)

15.2E (Cisco IOS)

16.12 (Cisco IOS XE)

15.2EY (Cisco IOS)

15.2EX (Cisco IOS)

15.2EB (Cisco IOS)

15.2EC (Cisco IOS)

12.2I (Cisco IOS)

15.9M (Cisco IOS)

15.1SVS (Cisco IOS)

3.11E (Cisco IOS XE)

17.1 (Cisco IOS XE)

15.1SVR (Cisco IOS)

15.1SVT (Cisco IOS)

15.1SVU (Cisco IOS)

15.1SVV (Cisco IOS)

15.1SVX (Cisco IOS)

15.1SVW (Cisco IOS)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Cisco Systems Inc. Cisco IOS 15.3s

Cisco Systems Inc. Cisco IOS XE 16.1

Cisco Systems Inc. Cisco IOS XE 16.2

Cisco Systems Inc. Cisco IOS XE 3.9S

Cisco Systems Inc. Cisco IOS XE 3.3XO

Cisco Systems Inc. Cisco IOS XE 16.3

Cisco Systems Inc. Cisco IOS XE 3.7E

Cisco Systems Inc. Cisco IOS XE 3.8E

Cisco Systems Inc. Cisco IOS XE 3.9E

Cisco Systems Inc. Cisco IOS XE 3.10S

Cisco Systems Inc. Cisco IOS XE 3.15S

Cisco Systems Inc. Cisco IOS XE 3.16S

Cisco Systems Inc. Cisco IOS XE 3.17S

Cisco Systems Inc. Cisco IOS XE 16.4

Cisco Systems Inc. Cisco IOS XE 16.5

Cisco Systems Inc. Cisco IOS XE 16.6

Cisco Systems Inc. Cisco IOS XE 16.7

Cisco Systems Inc. Cisco IOS XE 16.8

Cisco Systems Inc. Cisco IOS XE 16.9

Cisco Systems Inc. Cisco IOS XE 16.10

Cisco Systems Inc. Cisco IOS XE 16.11

Cisco Systems Inc. Cisco IOS XE 17.2

Cisco Systems Inc. Cisco IOS XE 17.3

Cisco Systems Inc. Cisco IOS XE 3.7S

Cisco Systems Inc. Cisco IOS XE 3.8S

Cisco Systems Inc. Cisco IOS XE 3.4SG

Cisco Systems Inc. Cisco IOS XE 3.5E

Cisco Systems Inc. Cisco IOS XE 3.11S

Cisco Systems Inc. Cisco IOS XE 3.12S

Cisco Systems Inc. Cisco IOS XE 3.13S

Cisco Systems Inc. Cisco IOS XE 3.6E

Cisco Systems Inc. Cisco IOS XE 3.14S

Cisco Systems Inc. Cisco IOS XE 3.18S

Cisco Systems Inc. Cisco IOS XE 3.18SP

Cisco Systems Inc. Cisco IOS XE 3.10E

Cisco Systems Inc. Cisco IOS 15.2S

Cisco Systems Inc. Cisco IOS 15.1SY

Cisco Systems Inc. Cisco IOS 15.4S

Cisco Systems Inc. Cisco IOS 15.2SC

Cisco Systems Inc. Cisco IOS 15.5S

Cisco Systems Inc. Cisco IOS 15.3SY

Cisco Systems Inc. Cisco IOS 15.6SP

Cisco Systems Inc. Cisco IOS 15.4SY

Cisco Systems Inc. Cisco IOS 15.5SY

Cisco Systems Inc. Cisco IOS 15.7M

Cisco Systems Inc. Cisco IOS 15.8M

Cisco Systems Inc. Cisco IOS 15.3T

Cisco Systems Inc. Cisco IOS 15.1M

Cisco Systems Inc. Cisco IOS 15.2M

Cisco Systems Inc. Cisco IOS 15.2GC

Cisco Systems Inc. Cisco IOS 15.4T

Cisco Systems Inc. Cisco IOS 15.4M

Cisco Systems Inc. Cisco IOS 15.4CG

Cisco Systems Inc. Cisco IOS 15.4SN

Cisco Systems Inc. Cisco IOS 15.5M

Cisco Systems Inc. Cisco IOS 15.5SN

Cisco Systems Inc. Cisco IOS 15.6S

Cisco Systems Inc. Cisco IOS 15.6T

Cisco Systems Inc. Cisco IOS 15.5XB

Cisco Systems Inc. Cisco IOS 15.6SN

Cisco Systems Inc. Cisco IOS 15.6M

Cisco Systems Inc. Cisco IOS 15.1SG

Cisco Systems Inc. Cisco IOS 15.2E

Cisco Systems Inc. Cisco IOS XE 16.12

Cisco Systems Inc. Cisco IOS 15.2EY

Cisco Systems Inc. Cisco IOS 15.2EX

Cisco Systems Inc. Cisco IOS 15.2EB

Cisco Systems Inc. Cisco IOS 15.2EC

Cisco Systems Inc. Cisco IOS 12.2I

Cisco Systems Inc. Cisco IOS 15.9M

Cisco Systems Inc. Cisco IOS 15.1SVS

Cisco Systems Inc. Cisco IOS XE 3.11E

Cisco Systems Inc. Cisco IOS XE 17.1

Cisco Systems Inc. Cisco IOS 15.1SVR

Cisco Systems Inc. Cisco IOS 15.1SVT

Cisco Systems Inc. Cisco IOS 15.1SVU

Cisco Systems Inc. Cisco IOS 15.1SVV

Cisco Systems Inc. Cisco IOS 15.1SVX

Cisco Systems Inc. Cisco IOS 15.1SVW

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)

Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,6)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dhcpv6-dos-44cMvdDK

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dhcpv6-dos-44cMvdDK

Идентификаторы других систем описаний уязвимостей

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-20080
CVE

EPSS

Процентиль: 41%

0.00195

Низкий

8.6 High

CVSS3

7.8 High

CVSS2

Связанные уязвимости

CVE-2023-20080

CVSS3: 8.6

nvd

почти 3 года назад

A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to insufficient validation of data boundaries. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly.

GHSA-m5h2-j2j6-cwcw

CVSS3: 7.5

github