CVE-2023-20003 json
Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass Vulnerability
published 2023-05-18 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24182
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.
Patch / fix
- cisco business_140ac_access_point_firmware 10.8.1.0
- cisco business_141acm_firmware 10.8.1.0
- cisco business_142acm_firmware 10.8.1.0
- cisco business_143acm_firmware 10.8.1.0
- cisco business_145ac_access_point_firmware 10.8.1.0
- cisco business_240ac_access_point_firmware 10.8.1.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Cisco Cisco Business Wireless Access Point Software
Classification
References
Sources
- CVE List CVE-2023-20003
- NVD CVE-2023-20003
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.