CVE-2023-20210

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-12 · updated 2026-06-17
Weakness: CWE-250

Description

A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device. The vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing a crafted command to the affected system. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, an attacker must have valid BroadWorks administrative privileges on the affected device.

Affected products

Cisco Broadworks Application Delivery Platform Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Application Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Database Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Database Troubleshooting Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Execution Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Media Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Messaging Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Network Database Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Network Function Manager Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Network Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Profile Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Service Control Function Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Sharing Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Video Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Webrtc Server Firmware: 23.0, 24.0, 25.0
Cisco Broadworks Xtended Services Platform Firmware: 23.0, 24.0, 25.0

References

Get alerted when CVE-2023-20210 or the next vulnerability affects your stack