CVE-2023-20236
Estado: ModificadaAlta (7.8)—
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.
This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.10%
- Percentil entre todas las CVEs puntuadas: 1
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-347
- CWE-345
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-20236",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-20236",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2023-11-15T16:36:16.200980Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.7,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 0.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco IOS XR Software",
"versions": [
{
"status": "affected",
"version": "5.2.0"
},
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.2"
},
{
"status": "affected",
"version": "5.2.4"
},
{
"status": "affected",
"version": "5.2.3"
},
{
"status": "affected",
"version": "5.2.5"
},
{
"status": "affected",
"version": "5.2.47"
},
{
"status": "affected",
"version": "5.3.0"
},
{
"status": "affected",
"version": "5.3.1"
},
{
"status": "affected",
"version": "5.3.2"
},
{
"status": "affected",
"version": "5.3.3"
},
{
"status": "affected",
"version": "5.3.4"
},
{
"status": "affected",
"version": "6.0.0"
},
{
"status": "affected",
"version": "6.0.1"
},
{
"status": "affected",
"version": "6.0.2"
},
{
"status": "affected",
"version": "6.1.1"
},
{
"status": "affected",
"version": "6.1.2"
},
{
"status": "affected",
"version": "6.1.3"
},
{
"status": "affected",
"version": "6.1.4"
},
{
"status": "affected",
"version": "6.1.12"
},
{
"status": "affected",
"version": "6.1.22"
},
{
"status": "affected",
"version": "6.1.32"
},
{
"status": "affected",
"version": "6.1.36"
},
{
"status": "affected",
"version": "6.1.42"
},
{
"status": "affected",
"version": "6.2.1"
},
{
"status": "affected",
"version": "6.2.2"
},
{
"status": "affected",
"version": "6.2.3"
},
{
"status": "affected",
"version": "6.2.25"
},
{
"status": "affected",
"version": "6.2.11"
},
{
"status": "affected",
"version": "6.3.2"
},
{
"status": "affected",
"version": "6.3.3"
},
{
"status": "affected",
"version": "6.3.15"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.5.1"
},
{
"status": "affected",
"version": "6.5.2"
},
{
"status": "affected",
"version": "6.5.3"
},
{
"status": "affected",
"version": "6.5.25"
},
{
"status": "affected",
"version": "6.5.26"
},
{
"status": "affected",
"version": "6.5.28"
},
{
"status": "affected",
"version": "6.5.29"
},
{
"status": "affected",
"version": "6.5.32"
},
{
"status": "affected",
"version": "6.5.33"
},
{
"status": "affected",
"version": "6.6.2"
},
{
"status": "affected",
"version": "6.6.3"
},
{
"status": "affected",
"version": "6.6.25"
},
{
"status": "affected",
"version": "6.6.4"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.0.12"
},
{
"status": "affected",
"version": "7.0.14"
},
{
"status": "affected",
"version": "7.1.1"
},
{
"status": "affected",
"version": "7.1.15"
},
{
"status": "affected",
"version": "7.1.2"
},
{
"status": "affected",
"version": "7.1.3"
},
{
"status": "affected",
"version": "6.7.1"
},
{
"status": "affected",
"version": "6.7.2"
},
{
"status": "affected",
"version": "6.7.3"
},
{
"status": "affected",
"version": "6.7.4"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.3.15"
},
{
"status": "affected",
"version": "7.3.2"
},
{
"status": "affected",
"version": "7.3.3"
},
{
"status": "affected",
"version": "7.3.5"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "6.8.1"
},
{
"status": "affected",
"version": "6.8.2"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.1"
},
{
"status": "affected",
"version": "7.7.2"
},
{
"status": "affected",
"version": "7.7.21"
},
{
"status": "affected",
"version": "6.9.1"
},
{
"status": "affected",
"version": "6.9.2"
},
{
"status": "affected",
"version": "7.8.1"
},
{
"status": "affected",
"version": "7.8.2"
},
{
"status": "affected",
"version": "7.9.1"
},
{
"status": "affected",
"version": "7.9.2"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:o:cisco:ios_xr_software:*:*:*:*:*:*:*:*"
],
"vendor": "cisco",
"product": "ios_xr_software",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "7.9.2"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2023-09-13T17:15:09.607",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-345"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.\r\n\r This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la función de arranque iPXE del software Cisco IOS XR podría permitir que un atacante local autenticado instale una imagen de software no verificada en un dispositivo afectado. Esta vulnerabilidad se debe a una verificación de imagen insuficiente. Un atacante podría aprovechar esta vulnerabilidad manipulando los parámetros de arranque para la verificación de imágenes durante el proceso de arranque iPXE en un dispositivo afectado. Una explotación exitosa podría permitir al atacante iniciar una imagen de software no verificada en el dispositivo afectado."
}
],
"lastModified": "2026-06-17T05:29:59.570",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F31C819-2725-4295-8FF3-BA00A7A6BE92",
"versionEndExcluding": "7.10.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3D8E7FFF-82A8-4ECB-BA0C-CBF0C2FDA3A3"
},
{
"criteria": "cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "87DC4C2F-01C5-4D89-8D79-E5D28EDAD0F2"
},
{
"criteria": "cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A34DAD43-0C95-4830-8078-EFE3E6C0A930"
},
{
"criteria": "cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "46F5CBF0-7F55-44C0-B321-896BDBA22679"
},
{
"criteria": "cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D381E343-416F-42AF-A780-D330954F238F"
},
{
"criteria": "cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6655851F-58D9-49D9-A56E-8440A7F7BB45"
},
{
"criteria": "cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F5E2AE67-DED3-4414-A194-386ADB2C8DC7"
},
{
"criteria": "cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3920133A-684D-4A9F-B65A-FF4EAE5052E5"
},
{
"criteria": "cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9ED06361-5A68-4656-AEA5-240C290594CD"
},
{
"criteria": "cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BE2514A1-486C-40F7-8746-56E2B973CBE6"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3FEF8271-315F-4756-931F-015F790BE693"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "71BD158E-71D8-4DCA-8C09-F8AB7EF0EBDD"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "324C97E6-1810-404F-9F45-6240F99FF039"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "57EB55BB-41B7-40A1-B6F5-142FE8AB4C16"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "433F4A82-04A4-4EAA-8C19-F7581DCD8D29"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2D5E60AB-94FF-448A-89D8-5D2197E21C74"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9902:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "91474DBC-FB31-4DDF-96C5-311FA1D53A74"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FA241214-2F05-4360-9B50-385355E29CF4"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A93212A4-50AB-42E7-89A4-5FBBAEA050C3"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EDA53A61-98B3-458C-8893-61CD7D6B1E48"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F396564E-B477-4A27-A189-CEB737552E25"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5445CC54-ACFB-4070-AF26-F91FEAA85181"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9920:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "49E7ED87-8AC0-4107-A7A5-F334236E2906"
},
{
"criteria": "cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D7AA58E5-D7E1-48CF-93FF-C60EB85B2BC7"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0F6E0FBE-70B7-413C-8943-39BEFE050298"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "37AE5FB0-D9A6-4EBE-9F7F-243299AE918B"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "60C9AAF8-4C5B-4EF5-B575-8235F3C54BCC"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4009:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F40E779D-5865-4E4B-AE2D-CF1860BA19E2"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4016:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DC6A867F-E809-4CB5-82DB-2670CB0A6359"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4201:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "41C5ECF8-EFFE-4C27-8DCB-2533BFD5200F"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4202:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "68C23248-3D61-4BAF-9602-BA31FB4374DD"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4206:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C36494B4-8E2D-4399-97B5-725792BD5C45"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4216:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0819EF17-5102-45FF-96AD-85BE17FD6921"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5001:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E2A8C028-107B-4410-BCC6-5BCB8DB63603"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5002:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DA13FE67-F4AE-46DF-921B-3FB91BDF742B"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5011:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "98622F14-CC47-45E0-85E4-A7243309487C"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_540:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BC7AE6C1-B7C6-4056-9719-B5CFF71970AD"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D686F339-9406-4ADF-B124-C815D43E4CAA"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5501:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0A972EFE-4F7E-4BFC-8631-66A2D16B74A3"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5501:se:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "22FE69B4-DF27-46F1-8037-4B8D1F229C6B"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5502:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7F72AEF0-EE70-40F8-B52B-1390820B87BB"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5502:se:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "603980FE-9865-4A71-A37C-A90B7F3B72D6"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5504:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6AC4E089-296D-4C19-BF21-DDF2501DD77C"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "43D21B01-A754-474F-8E46-14D733AB307E"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "17D6424C-972F-459C-B8F7-04FFD9F541BC"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_560:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D4CC8256-E4F8-4DCB-B69A-40A7C5AA41E8"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_560-4:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BB01E968-E838-4D3C-B603-BF7E4E0F8A2C"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_560-7:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "08864A59-0840-4407-8D30-9CE34BAF05E7"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57b1-5dse-sys:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "13EEDD1C-25BC-4AFA-AF60-66DE36927528"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57b1-6d24-sys:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5CD3B06B-864E-4A35-B0C3-1654390022D2"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57c1-48q6-sys:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AD1B4F37-5AAA-4F40-8865-226289CB5CEB"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57c3-mod-sys:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "355F78C3-C07F-48C3-9B6E-55714EAA7331"
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57c3-mods-sys:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "98F06B5D-6CE8-42C3-8760-89B4EF1FFC21"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}