Skip to content
Fencer Vulns
high 8.6

CVE-2023-20161 in the critical feed json

Cisco Small Business Series Switches Buffer Overflow Vulnerabilities

published 2023-05-18 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24340

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
11.1%
EPSS 11.1% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.

Patch / fix

  • cisco 250_series_smart_switches_firmware 2.5.9.16
  • cisco 350_series_managed_switches_firmware 2.5.9.16
  • cisco 350x_series_stackable_managed_switches_firmware 2.5.9.16
  • cisco 550x_series_stackable_managed_switches_firmware 2.5.9.16
  • cisco business_250_series_smart_switches_firmware 3.3.0.16
  • cisco business_350_series_managed_switches_firmware 3.3.0.16

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

11.11% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Cisco Cisco Small Business Smart and Managed Switches
  • cisco 250_series_smart_switches_firmware
  • cisco 350_series_managed_switches_firmware
  • cisco 350x_series_stackable_managed_switches_firmware
  • cisco 550x_series_stackable_managed_switches_firmware
  • cisco business_250_series_smart_switches_firmware
  • cisco business_350_series_managed_switches_firmware
  • cisco small_business_200_series_smart_switches_firmware
  • cisco small_business_300_series_managed_switches_firmware
  • cisco small_business_500_series_stackable_managed_switches_firmware

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.