A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker…

published 2023-08-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24395

cvss: 4.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits: 0; none known

A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a user with the BWORKS or BWSUPERADMIN role and issuing crafted commands on an affected system. A successful exploit could allow the attacker to execute commands beyond the sphere of their intended access level, including initiating installs or running operating system commands with elevated permissions. There are workarounds that address this vulnerability.

Patch / fix

fixed in 12

cisco broadworks_application_delivery_platform ri.2023.05
cisco broadworks_application_server 23.0.2023.05, 24.0.2023.05, 2023.05
cisco broadworks_database_server 2023.05
cisco broadworks_execution_server 2023.05
cisco broadworks_media_server 2023.05
cisco broadworks_network_database_server 2023.05
cisco broadworks_network_function_manager 2023.05
cisco broadworks_network_server 23.0.2023.05, 2023.05
cisco broadworks_profile_server 23.0.2023.05, 2023.05
cisco broadworks_service_control_function_server 2023.05
cisco broadworks_troubleshooting_server 2023.06
cisco broadworks_xtended_services_platform 23.0.2023.05, 2023.05

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Cisco Cisco BroadWorks

Classification

Weakness

CWE-269 Improper Privilege Management
CWE-732 Incorrect Permission Assignment for Critical Resource

References

sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-priv-esc-qTgUZOsQ
vendor-advisory

Sources

CVE List CVE-2023-20216
NVD CVE-2023-20216

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary