CVE-2023-20238 is a critical authentication bypass in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform that could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system.

An attacker could exploit this vulnerability by using forged credentials to authenticate to the application. The attacker could then execute commands at the level of the forged account.

The impact on data confidentiality, integrity and service availability is high.

The Centre for Cyber Security Belgium strongly recommends system administrators to take the following actions:

 

Update

Install the patches released by Cisco: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdv...

 

Mitigate/workaround

No specific mitigations or workaround provided by Cisco.

 

Monitor/Detect

The CCB recommends organizations to upscale monitoring and detection capabilities and to detect any related suspicious activity, ensuring a fast response in case of an intrusion. While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise. When applying patches to systems that have been vulnerable to an authentication bypass, a proactive threat assessment should be performed to verify the device was not accessed from an unknown IP or location.