CVE-2023-20235
Estado: ModificadaAlta (8.8)—
A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user.
This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.68%
- Percentil entre todas las CVEs puntuadas: 51
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-552
- CWE-269
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-20235",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-20235",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-04-10T04:00:24.398281Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 1.2
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco IOS XE Software",
"versions": [
{
"status": "affected",
"version": "17.3.1"
},
{
"status": "affected",
"version": "17.3.2"
},
{
"status": "affected",
"version": "17.3.3"
},
{
"status": "affected",
"version": "17.3.1a"
},
{
"status": "affected",
"version": "17.3.1w"
},
{
"status": "affected",
"version": "17.3.2a"
},
{
"status": "affected",
"version": "17.3.1x"
},
{
"status": "affected",
"version": "17.3.1z"
},
{
"status": "affected",
"version": "17.3.4"
},
{
"status": "affected",
"version": "17.3.5"
},
{
"status": "affected",
"version": "17.3.4a"
},
{
"status": "affected",
"version": "17.3.6"
},
{
"status": "affected",
"version": "17.3.4b"
},
{
"status": "affected",
"version": "17.3.4c"
},
{
"status": "affected",
"version": "17.3.5a"
},
{
"status": "affected",
"version": "17.3.5b"
},
{
"status": "affected",
"version": "17.3.7"
},
{
"status": "affected",
"version": "17.4.1"
},
{
"status": "affected",
"version": "17.4.2"
},
{
"status": "affected",
"version": "17.4.1a"
},
{
"status": "affected",
"version": "17.4.1b"
},
{
"status": "affected",
"version": "17.4.2a"
},
{
"status": "affected",
"version": "17.5.1"
},
{
"status": "affected",
"version": "17.5.1a"
},
{
"status": "affected",
"version": "17.5.1b"
},
{
"status": "affected",
"version": "17.5.1c"
},
{
"status": "affected",
"version": "17.6.1"
},
{
"status": "affected",
"version": "17.6.2"
},
{
"status": "affected",
"version": "17.6.1w"
},
{
"status": "affected",
"version": "17.6.1a"
},
{
"status": "affected",
"version": "17.6.1x"
},
{
"status": "affected",
"version": "17.6.3"
},
{
"status": "affected",
"version": "17.6.1y"
},
{
"status": "affected",
"version": "17.6.1z"
},
{
"status": "affected",
"version": "17.6.3a"
},
{
"status": "affected",
"version": "17.6.4"
},
{
"status": "affected",
"version": "17.6.1z1"
},
{
"status": "affected",
"version": "17.6.5"
},
{
"status": "affected",
"version": "17.6.5a"
},
{
"status": "affected",
"version": "17.7.1"
},
{
"status": "affected",
"version": "17.7.1a"
},
{
"status": "affected",
"version": "17.7.1b"
},
{
"status": "affected",
"version": "17.7.2"
},
{
"status": "affected",
"version": "17.10.1"
},
{
"status": "affected",
"version": "17.10.1a"
},
{
"status": "affected",
"version": "17.10.1b"
},
{
"status": "affected",
"version": "17.8.1"
},
{
"status": "affected",
"version": "17.8.1a"
},
{
"status": "affected",
"version": "17.9.1"
},
{
"status": "affected",
"version": "17.9.1w"
},
{
"status": "affected",
"version": "17.9.2"
},
{
"status": "affected",
"version": "17.9.1a"
},
{
"status": "affected",
"version": "17.9.1x"
},
{
"status": "affected",
"version": "17.9.1y"
},
{
"status": "affected",
"version": "17.9.3"
},
{
"status": "affected",
"version": "17.9.2a"
},
{
"status": "affected",
"version": "17.9.1x1"
},
{
"status": "affected",
"version": "17.9.3a"
},
{
"status": "affected",
"version": "17.9.4"
},
{
"status": "affected",
"version": "17.9.1y1"
},
{
"status": "affected",
"version": "17.9.4a"
},
{
"status": "affected",
"version": "17.11.1"
},
{
"status": "affected",
"version": "17.11.1a"
},
{
"status": "affected",
"version": "17.12.1"
},
{
"status": "affected",
"version": "17.12.1a"
},
{
"status": "affected",
"version": "17.11.99SW"
}
]
}
]
}
],
"published": "2023-10-04T17:15:09.917",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rdocker-uATbukKn",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rdocker-uATbukKn",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-552"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user.\r\n\r This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la función de flujo de trabajo de desarrollo de aplicaciones en el dispositivo para la infraestructura de alojamiento de aplicaciones Cisco IOx en el software Cisco IOS XE podría permitir que un atacante remoto autenticado acceda al sistema operativo subyacente como usuario root. Esta vulnerabilidad existe porque los contenedores Docker con la opción de tiempo de ejecución privilegiado no se bloquean cuando están en modo de desarrollo de aplicaciones. Un atacante podría aprovechar esta vulnerabilidad utilizando la CLI de Docker para acceder a un dispositivo afectado. El flujo de trabajo de desarrollo de aplicaciones está destinado a usarse únicamente en sistemas de desarrollo y no en sistemas de producción."
}
],
"lastModified": "2026-06-17T05:29:59.420",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "100403F0-0796-4993-A2AF-6A14EDC84478",
"versionEndExcluding": "17.3.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "86879AC0-890E-42F4-9561-6851F38FE0AD"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19017B10-F630-42CD-ACD2-E817FEF0E7F1"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9C7CCC02-113E-4EA1-B0CA-9FDF1108BB71"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir1101:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "68D183A4-2B4D-4DFB-B7F3-2B7AEC0E759E"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir1821-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "564DB1E0-7FDA-4E6B-8ABF-4A7BDB07BABE"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir1831-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E218F9E1-8CB9-472D-815D-EAC68D1F5F9D"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir1833-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "31498808-5603-43A2-B7F1-D6111F824F9B"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir1835-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9B112725-CB72-48FC-8C73-3FCFF7DADF4F"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir8140h-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CA64916D-3743-4A5F-9021-07EB0B352FF9"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir8140h-p-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BC6129CB-2C8F-4786-AE76-89C4866BE0E3"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_ir8340-k9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8C9D37A1-D1AA-45B7-861B-046863A67727"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-24t-con-a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D4C98B90-69B3-4BDF-A569-4C102498BFAD"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-24t-con-e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7646B0A1-FDF5-4A60-A451-E84CE355302E"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-24t-ncp-a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FA889066-14A8-4D88-9EFF-582FE1E65108"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-24t-ncp-e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2A0C09AE-CD2A-486A-82D4-2F26AA6B6B95"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-con-a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BEF81CC0-AEED-42DE-B423-8F4E118680BA"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-con-e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EDAAFDF1-7A3C-475F-AE82-B3194939D401"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-ncp-a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9566FC8C-0357-4780-976F-8A68E6A7D24A"
},
{
"criteria": "cpe:2.3:h:cisco:ess-3300-ncp-e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "07503D21-965B-49F0-B8F2-B5ECD656F277"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}