CVE-2023-20238 is a critical authentication bypass vulnerability (CVSS 10.0) in the Cisco BroadWorks Application Delivery Platform and Xtended Services Platform. The flaw stems from improper validation of Single Sign-On (SSO) tokens, which allows unauthenticated remote attackers to forge credentials and gain unauthorized access. Exploitation can lead to toll fraud, unauthorized command execution, and the exposure or modification of sensitive data.

Technical Summary

The vulnerability arises from the method used to validate SSO tokens, allowing attackers to authenticate using forged credentials. Successful exploitation could allow an attacker to commit toll fraud or execute commands with the privileges associated with the spoofed account. If the spoofed account has administrative rights, the attacker could access confidential information, modify customer settings, or alter other users’ configurations. Exploitation of this vulnerability requires a valid user ID associated with a vulnerable Cisco BroadWorks system.

Recommendations

• Apply the Cisco Security Update: Upgrade to the corrected versions provided by Cisco to mitigate the vulnerability. Key fixed versions include:

• BroadWorks Application Delivery Platform: AP.platform.23.0.1075.ap385341

• Release Independent (RI) versions: 2023.061.333 and 2023.071.332

• For BroadWorks 22.0 and earlier versions: Migrate to a corrected release such as version 23.0.1075.ap385341.

• Review and Monitor Logs: Regularly analyze authentication logs for anomalous access or unauthorized login attempts.

• Implement Network Segmentation: Isolate BroadWorks systems from untrusted networks to reduce exposure.

• Stay Informed: Constantly monitor Cisco security advisories for further updates or related vulnerabilities.

[Callforaction-THREAT-Footer]