Loading...
Loading...
This product includes Third-party Software that is affected by the vulnerabilities identified by the following Common Vulnerability and Exposures (CVE) IDs: CVE-2023-46445 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46445 CVE-2023-46446 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46446 CVE-2023-48795 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795 The affected third-party software component has been upgraded to a version that includes fixes for the vulnerability. Future versions of the product(s) will not be affected by this vulnerability.
Device with default configuration.
Device requires chacha20-poly1305@openssh.com encryption algorithm, or any encryption algorithm suffixed -cbc in combination with any MAC algorithm suffixed -etm@openssh.com, to be vulnerable to Terrapin. Customers can disable these encryption algorithms using the "ip ssh server algorithm encryption" command. See https://community.cisco.com/t5/networking-knowledge-base/configuring-ios-xe-for-strong-security-ssh-sessions/tac-p/4912351 for additional information.
Additional details about the vulnerabilities listed above can be found at https://www.cve.org/. PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 3.1 score. The Base CVSS score as of the time of evaluation is: 6.8 https://tools.cisco.com/security/center/cvssCalculator.x?version=3.1&vector=CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVE ID CVE-2023-46445, CVE-2023-46446, CVE-2023-48795 have been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.