CVE-2023-20216: Privilege Escalation in Cisco BroadWorks Servers
CVE-2023-20216 Published on August 3, 2023

A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a user with the BWORKS or BWSUPERADMIN role and issuing crafted commands on an affected system. A successful exploit could allow the attacker to execute commands beyond the sphere of their intended access level, including initiating installs or running operating system commands with elevated permissions. There are workarounds that address this vulnerability.

NVD

Vulnerability Analysis

CVE-2023-20216 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Improper Privilege Management

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.


Products Associated with CVE-2023-20216

Want to know whenever a new CVE is published for Cisco products? stack.watch will email you.

Cisco Broadworks Application Server
 
Cisco Broadworks Application Delivery Platform
 
Cisco Broadworks Network Server
 
Cisco Broadworks Profile Server
 
Cisco Broadworks Xtended Services Platform
 
Cisco Broadworks Troubleshooting Server
 
Cisco Broadworks Network Function Manager
 
Cisco Broadworks Network Database Server
 
Cisco Broadworks Execution Server
 
Cisco Broadworks Database Server
 
Cisco Broadworks Service Control Function Server
 
Cisco Broadworks Media Server
 
Cisco Broadworks
 

Affected Versions

Cisco BroadWorks:

Exploit Probability

EPSS
0.01%
Percentile
1.53%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.