Auth bypass in Cisco Business 140ac Access Point
CVE-2023-20003
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 25.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Cisco Business 140ac Access Point
- Cisco Business 140ac Access Point Firmware
- Cisco Business 141acm
- Cisco Business 141acm Firmware
- Cisco Business 142acm
- Cisco Business 142acm Firmware
- Cisco Business 143acm
- Cisco Business 143acm Firmware
- Cisco Business 145ac Access Point
- Cisco Business 145ac Access Point Firmware
Weakness classification (CWE)
References
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-20003?
- CVE-2023-20003 is a medium-severity vulnerability in Cisco Business 140ac Access Point, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 4.7/10. Published 2023-05-18.
- How severe is CVE-2023-20003?
- Medium severity. CVSS v3 base score is 4.7 out of 10.