CVE-2023-20016 Cisco FXOS Software and UCS Manager Software Configuration Backup Static Key Vulnerability
An attacker with access to backup files can decrypt sensitive credentials due to a static encryption key in Cisco UCS Manager and FXOS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-20016?
CVE-2023-20016 is a medium-severity vulnerability in Cisco Unified Computing System (Managed), published on 23 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method used for the backup function. An attacker could exploit this vulnerability by leveraging a static key used for the backup configuration feature. A successful exploit could allow the attacker to decrypt sensitive information that is stored in full state and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and other credentials.
Which versions are affected by CVE-2023-20016?
It affects 12 products.
Products include Cisco Fxos, Cisco Ucs 6200 Firmware, Cisco Ucs 6248up Firmware, Cisco Ucs 6296up Firmware, Cisco Ucs 6300 Firmware, Cisco Ucs 6324 Firmware and 6 more.
How do I fix CVE-2023-20016?
No fix has been published for CVE-2023-20016 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-20016 being exploited?
There is no known exploitation of CVE-2023-20016 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Computing System (Managed)
Sources
Also known as GHSA-xj38-cqqv-5f7w.