A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user.

This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco IOS XE Software affected
Version Status Constraints
17.3.1 affected —
17.3.2 affected —
17.3.3 affected —
17.3.1a affected —
17.3.1w affected —
17.3.2a affected —
17.3.1x affected —
17.3.1z affected —
17.3.4 affected —
17.3.5 affected —
17.3.4a affected —
17.3.6 affected —
17.3.4b affected —
17.3.4c affected —
17.3.5a affected —
17.3.5b affected —
17.3.7 affected —
17.4.1 affected —
17.4.2 affected —
17.4.1a affected —
17.4.1b affected —
17.4.2a affected —
17.5.1 affected —
17.5.1a affected —
17.5.1b affected —
17.5.1c affected —
17.6.1 affected —
17.6.2 affected —
17.6.1w affected —
17.6.1a affected —
17.6.1x affected —
17.6.3 affected —
17.6.1y affected —
17.6.1z affected —
17.6.3a affected —
17.6.4 affected —
17.6.1z1 affected —
17.6.5 affected —
17.6.5a affected —
17.7.1 affected —
17.7.1a affected —
17.7.1b affected —
17.7.2 affected —
17.10.1 affected —
17.10.1a affected —
17.10.1b affected —
17.8.1 affected —
17.8.1a affected —
17.9.1 affected —
17.9.1w affected —
17.9.2 affected —
17.9.1a affected —
17.9.1x affected —
17.9.1y affected —
17.9.3 affected —
17.9.2a affected —
17.9.1x1 affected —
17.9.3a affected —
17.9.4 affected —
17.9.1y1 affected —
17.9.4a affected —
17.11.1 affected —
17.11.1a affected —
17.12.1 affected —
17.12.1a affected —
17.11.99SW affected —

Configuration 1 [-]

AND
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir1101:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir1821-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir1831-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir1833-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir1835-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir8140h-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir8140h-p-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:catalyst_ir8340-k9:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-24t-con-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-24t-con-e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-24t-ncp-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-24t-ncp-e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-con-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-con-e:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-ncp-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ess-3300-ncp-e:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Catalyst Ie3200 Rugged Switch Subscribe
Catalyst Ie3300 Rugged Switch Subscribe
Catalyst Ie3400 Rugged Switch Subscribe
Catalyst Ir1101 Subscribe
Catalyst Ir1821-k9 Subscribe
Catalyst Ir1831-k9 Subscribe
Catalyst Ir1833-k9 Subscribe
Catalyst Ir1835-k9 Subscribe
Catalyst Ir8140h-k9 Subscribe
Catalyst Ir8140h-p-k9 Subscribe
Catalyst Ir8340-k9 Subscribe
Ess-3300-24t-con-a Subscribe
Ess-3300-24t-con-e Subscribe
Ess-3300-24t-ncp-a Subscribe
Ess-3300-24t-ncp-e Subscribe
Ess-3300-con-a Subscribe
Ess-3300-con-e Subscribe
Ess-3300-ncp-a Subscribe
Ess-3300-ncp-e Subscribe
Ios Xe Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24414 A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user. This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rdocker-uATbukKn cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-08-02T09:05:36.672Z

Reserved: 2022-10-27T18:47:50.369Z

Link: CVE-2023-20235

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-10-04T17:15:09.917

Modified: 2024-11-21T07:40:57.567

Link: CVE-2023-20235

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses