Auth bypass in Cisco Business 140ac Access Point
CVE-2023-20003
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.
EPSS: 0.003 (26.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.
Affected products
- Cisco Business_140ac_access_point
- Cisco Business_140ac_access_point_firmware
- Cisco Business_141acm
- Cisco Business_141acm_firmware
- Cisco Business_142acm
- Cisco Business_142acm_firmware
- Cisco Business_143acm
- Cisco Business_143acm_firmware
- Cisco Business_145ac_access_point
- Cisco Business_145ac_access_point_firmware
Weakness classification (CWE)
References
- psirt@cisco.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-20003?
- CVE-2023-20003 is a medium-severity vulnerability in Cisco Business 140ac Access Point, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 4.7/10. Published 2023-05-18.
- How severe is CVE-2023-20003?
- Medium severity. CVSS v3 base score is 4.7 out of 10.