What is CVE-2023-20223?

CVE-2023-20223 is a high-severity vulnerability affecting Cisco DNA Center devices. An unauthenticated, remote attacker can exploit this vulnerability to read and modify data in a repository belonging to an internal service on the affected device. This issue impacts systems running Cisco DNA Center versions up to 2.3.5.4. Organizations using these systems should address this vulnerability to secure their networks.

Who is impacted by CVE-2023-20223?

CVE-2023-20223 affects users of Cisco DNA Center devices running versions up to 2.3.5.4. This vulnerability allows an unauthenticated, remote attacker to read and modify data in a repository belonging to an internal service on the affected device. Organizations using these systems should take appropriate measures to secure their networks.

What to do if CVE-2023-20223 affected you

If you're affected by the CVE-2023-20223 vulnerability, it's important to take action to secure your network. Here's a simplified step-by-step guide:

1. Identify if your Cisco DNA Center device is running a version up to 2.3.5.4.

2. Visit the NVD page for more information on the vulnerability.

3. Contact Cisco support for guidance on updating your device to a secure version.

4. Monitor your network for any suspicious activity.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-20223 vulnerability in Cisco DNA Center is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on September 27, 2023. There is no specific due date or required action mentioned, but it is implied that users should update their Cisco DNA Center software to a secure version to address this vulnerability.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-284, which refers to improper access control in Cisco DNA Center devices.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page.

• NVD - CVE-2023-20223

• Cisco Security Advisory