HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2023-20227

CVSS 8.6v3.1pub. 2023-09-27upd. 2024-11-21

A vulnerability in the Layer 2 Tunneling Protocol (L2TP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could exploit this vulnerability by sending crafted L2TP packets to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

  • Cisco 1000 Integrated Services Router

    HW
    Cisco
    all versions

  • Cisco 1100 4g Integrated Services Router

    HW
    Cisco
    all versions

  • Cisco Catalyst 8000v Edge

    APP
    Cisco
    all versions

  • Cisco Cloud Services Router 1000v

    APP
    Cisco
    all versions

  • Cisco IOS XE

    OS
    Cisco
    16.10.116.10.1a16.10.1b16.10.1c16.10.1d16.10.1e16.10.1f16.10.1g16.10.1s16.10.216.10.316.11.116.11.1a16.11.1b16.11.1s+ 81 more
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2023-20198CRITICAL10.0⚠ KEVPL ✓same product

Cisco IOS XE Web UI — nieautoryzowane tworzenie konta z privilege 15

CVE-2018-0151CRITICAL9.8⚠ KEVPL ✓same product

Buffer overflow w QoS Cisco IOS/IOS XE — RCE i DoS przez UDP 18999

CVE-2017-12240CRITICAL9.8⚠ KEVPL ✓same product

Buffer overflow w DHCP relay Cisco IOS — RCE bez uwierzytelnienia

CVE-2017-3881CRITICAL9.8⚠ KEVPL ✓same product

RCE w Cisco IOS/IOS XE – podatność protokołu CMP przez Telnet

CVE-2026-20267CRITICAL9.0PL ✓same product

Nieprawidłowa kontrola dostępu w Cisco IOS XE Software (CVE-2026-20267)