CVE-2023-20268: Cisco Access Point Software Uncontrolled Resource Consumption Vulnerability
First published: Wed Sep 27 2023(Updated: )
A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device. This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Wireless LAN Controller Software | <8.10.190.0 | |
| Cisco Catalyst 9800 Embedded Wireless Controller Firmware | <17.3.8 | |
| Cisco Catalyst 9800 Embedded Wireless Controller Firmware | >=17.4.0<17.6.6 | |
| Cisco Catalyst 9800 Embedded Wireless Controller Firmware | >=17.8.0<17.9.4 | |
| Cisco Catalyst 9800 Embedded Wireless Controller | ||
| Cisco Business 150ax Firmware | <10.6.2.0 | |
| Cisco Business 150ax | ||
| Cisco Business 151axm Firmware | <10.6.2.0 | |
| Cisco Business 151axm | ||
| All of | ||
| Any of | ||
| Cisco Catalyst 9800 Embedded Wireless Controller Firmware | <17.3.8 | |
| Cisco Catalyst 9800 Embedded Wireless Controller Firmware | >=17.4.0<17.6.6 | |
| Cisco Catalyst 9800 Embedded Wireless Controller Firmware | >=17.8.0<17.9.4 | |
| Cisco Catalyst 9800 Embedded Wireless Controller | ||
| All of | ||
| Cisco Business 150ax Firmware | <10.6.2.0 | |
| Cisco Business 150ax | ||
| All of | ||
| Cisco Business 151axm Firmware | <10.6.2.0 | |
| Cisco Business 151axm |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-20268.
What is the severity of CVE-2023-20268?
The severity of CVE-2023-20268 is medium with a CVSS score of 4.7.
How does CVE-2023-20268 affect Cisco access point (AP) software?
CVE-2023-20268 affects Cisco access point (AP) software by allowing an unauthenticated, adjacent attacker to exhaust resources on an affected device.
What is the cause of CVE-2023-20268?
The cause of CVE-2023-20268 is insufficient management of resources when handling certain types of traffic.
How can CVE-2023-20268 be fixed?
To fix CVE-2023-20268, it is recommended to update to a version of Cisco access point (AP) software that is not affected by the vulnerability.
- collector/nvd-index
- agent/author
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/event
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/description
- vendor/cisco
- canonical/cisco wireless lan controller software
- canonical/cisco catalyst 9800 embedded wireless controller firmware
- version/cisco catalyst 9800 embedded wireless controller firmware/17.4.0
- version/cisco catalyst 9800 embedded wireless controller firmware/17.8.0
- canonical/cisco catalyst 9800 embedded wireless controller
- canonical/cisco business 150ax firmware
- canonical/cisco business 150ax
- canonical/cisco business 151axm firmware
- canonical/cisco business 151axm