A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.

This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco IOS XR Software affected
Version Status Constraints
5.2.0 affected —
5.2.1 affected —
5.2.2 affected —
5.2.4 affected —
5.2.3 affected —
5.2.5 affected —
5.2.47 affected —
5.3.0 affected —
5.3.1 affected —
5.3.2 affected —
5.3.3 affected —
5.3.4 affected —
6.0.0 affected —
6.0.1 affected —
6.0.2 affected —
6.1.1 affected —
6.1.2 affected —
6.1.3 affected —
6.1.4 affected —
6.1.12 affected —
6.1.22 affected —
6.1.32 affected —
6.1.36 affected —
6.1.42 affected —
6.2.1 affected —
6.2.2 affected —
6.2.3 affected —
6.2.25 affected —
6.2.11 affected —
6.3.2 affected —
6.3.3 affected —
6.3.15 affected —
6.4.1 affected —
6.4.2 affected —
6.4.3 affected —
6.5.1 affected —
6.5.2 affected —
6.5.3 affected —
6.5.25 affected —
6.5.26 affected —
6.5.28 affected —
6.5.29 affected —
6.5.32 affected —
6.5.33 affected —
6.6.2 affected —
6.6.3 affected —
6.6.25 affected —
6.6.4 affected —
7.0.1 affected —
7.0.2 affected —
7.0.12 affected —
7.0.14 affected —
7.1.1 affected —
7.1.15 affected —
7.1.2 affected —
7.1.3 affected —
6.7.1 affected —
6.7.2 affected —
6.7.3 affected —
6.7.4 affected —
7.2.0 affected —
7.2.1 affected —
7.2.2 affected —
7.3.1 affected —
7.3.15 affected —
7.3.2 affected —
7.3.3 affected —
7.3.5 affected —
7.4.1 affected —
7.4.2 affected —
6.8.1 affected —
6.8.2 affected —
7.5.1 affected —
7.5.3 affected —
7.5.2 affected —
7.5.4 affected —
7.6.1 affected —
7.6.2 affected —
7.7.1 affected —
7.7.2 affected —
7.7.21 affected —
6.9.1 affected —
6.9.2 affected —
7.8.1 affected —
7.8.2 affected —
7.9.1 affected —
7.9.2 affected —

Configuration 1 [-]

AND
cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9902:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9920:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_4009:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_4016:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_4201:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_4202:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_4206:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_4216:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5001:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5002:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5011:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_540:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5500:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5501:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5501:se:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5502:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5502:se:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5504:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_560:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_560-4:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_560-7:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_57b1-5dse-sys:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_57b1-6d24-sys:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_57c1-48q6-sys:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_57c3-mod-sys:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ncs_57c3-mods-sys:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
8201 Subscribe
8202 Subscribe
8208 Subscribe
8212 Subscribe
8218 Subscribe
8804 Subscribe
8808 Subscribe
8812 Subscribe
8818 Subscribe
8831 Subscribe
Asr 9000 Subscribe
Asr 9000v Subscribe
Asr 9001 Subscribe
Asr 9006 Subscribe
Asr 9010 Subscribe
Asr 9901 Subscribe
Asr 9902 Subscribe
Asr 9903 Subscribe
Asr 9904 Subscribe
Asr 9906 Subscribe
Asr 9910 Subscribe
Asr 9912 Subscribe
Asr 9920 Subscribe
Asr 9922 Subscribe
Ios Xr Subscribe
Ios Xr Software Subscribe
Ncs 1001 Subscribe
Ncs 1002 Subscribe
Ncs 1004 Subscribe
Ncs 4009 Subscribe
Ncs 4016 Subscribe
Ncs 4201 Subscribe
Ncs 4202 Subscribe
Ncs 4206 Subscribe
Ncs 4216 Subscribe
Ncs 5001 Subscribe
Ncs 5002 Subscribe
Ncs 5011 Subscribe
Ncs 540 Subscribe
Ncs 5500 Subscribe
Ncs 5501 Subscribe
Ncs 5502 Subscribe
Ncs 5504 Subscribe
Ncs 5508 Subscribe
Ncs 5516 Subscribe
Ncs 560 Subscribe
Ncs 560-4 Subscribe
Ncs 560-7 Subscribe
Ncs 57b1-5dse-sys Subscribe
Ncs 57b1-6d24-sys Subscribe
Ncs 57c1-48q6-sys Subscribe
Ncs 57c3-mod-sys Subscribe
Ncs 57c3-mods-sys Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24415 A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB cve-icon cve-icon
History

Wed, 17 Dec 2025 05:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Cisco ios Xr Software
CPEs cpe:2.3:o:cisco:ios_xr_software:*:*:*:*:*:*:*:*
Vendors & Products Cisco ios Xr Software
Metrics ssvc

{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2025-12-16T18:23:20.640Z

Reserved: 2022-10-27T18:47:50.370Z

Link: CVE-2023-20236

cve-icon Vulnrichment

Updated: 2024-08-02T09:05:35.905Z

cve-icon NVD

Status : Modified

Published: 2023-09-13T17:15:09.607

Modified: 2024-11-21T07:40:57.700

Link: CVE-2023-20236

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses