Details of VAR-202304-0151

ID

VAR-202304-0151

CVE

CVE-2023-20051

TITLE

Cisco Packet Data Network Gateway Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-001957

DESCRIPTION

A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP traffic from being processed over an IPsec connection. This vulnerability is due to the VPP improperly handling a malformed packet. An attacker could exploit this vulnerability by sending a malformed Encapsulating Security Payload (ESP) packet over an IPsec connection. A successful exploit could allow the attacker to stop ICMP traffic over an IPsec connection and cause a denial of service (DoS)

Trust: 1.71

sources: NVD: CVE-2023-20051 // JVNDB: JVNDB-2023-001957 // VULMON: CVE-2023-20051

AFFECTED PRODUCTS

vendor:	cisco	model:	packet data network gateway	scope:	lt	version:	21.28.0	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco packet data network gateway	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco packet data network gateway	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-001957 // NVD: CVE-2023-20051

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-20051
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2023-20051
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2023-20051
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202304-261
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2023-20051
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2023-20051
baseSeverity:	MEDIUM
baseScore:	5.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2023-20051
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-001957 // CNNVD: CNNVD-202304-261 // NVD: CVE-2023-20051 // NVD: CVE-2023-20051

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-001957 // NVD: CVE-2023-20051

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202304-261

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202304-261

PATCH

title:	cisco-sa-cisco-pdng-dos-KmzwEy2Q	url:	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pdng-dos-KmzwEy2Q	Trust: 0.8
title:	Cisco Packet Data Network Gateway Security vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=233008	Trust: 0.6
title:	Cisco: Cisco Packet Data Network Gateway IPsec ICMP Denial of Service Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-cisco-pdng-dos-KmzwEy2Q	Trust: 0.1

sources: VULMON: CVE-2023-20051 // JVNDB: JVNDB-2023-001957 // CNNVD: CNNVD-202304-261

EXTERNAL IDS

db:	NVD	id:	CVE-2023-20051	Trust: 3.3
db:	JVNDB	id:	JVNDB-2023-001957	Trust: 0.8
db:	AUSCERT	id:	ESB-2023.2016	Trust: 0.6
db:	CNNVD	id:	CNNVD-202304-261	Trust: 0.6
db:	VULMON	id:	CVE-2023-20051	Trust: 0.1

sources: VULMON: CVE-2023-20051 // JVNDB: JVNDB-2023-001957 // CNNVD: CNNVD-202304-261 // NVD: CVE-2023-20051

REFERENCES

url:	https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cisco-pdng-dos-kmzwey2q	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-20051	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-20051/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2023.2016	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2023-20051 // JVNDB: JVNDB-2023-001957 // CNNVD: CNNVD-202304-261 // NVD: CVE-2023-20051

SOURCES

db:	VULMON	id:	CVE-2023-20051
db:	JVNDB	id:	JVNDB-2023-001957
db:	CNNVD	id:	CNNVD-202304-261
db:	NVD	id:	CVE-2023-20051

LAST UPDATE DATE

2024-08-14T13:20:54.384000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-20051	date:	2023-04-05T00:00:00
db:	JVNDB	id:	JVNDB-2023-001957	date:	2023-05-29T06:03:00
db:	CNNVD	id:	CNNVD-202304-261	date:	2023-04-12T00:00:00
db:	NVD	id:	CVE-2023-20051	date:	2023-11-07T04:05:52.150

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-20051	date:	2023-04-05T00:00:00
db:	JVNDB	id:	JVNDB-2023-001957	date:	2023-05-29T00:00:00
db:	CNNVD	id:	CNNVD-202304-261	date:	2023-04-05T00:00:00
db:	NVD	id:	CVE-2023-20051	date:	2023-04-05T17:15:07.530