CVE-2023-20268 json
Cisco Access Point Software Uncontrolled Resource Consumption Vulnerability
published 2023-09-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24447
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device.
This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic.
Patch / fix
- cisco wireless_lan_controller_software 8.10.190.0
- cisco catalyst_9800_embedded_wireless_controller_firmware 17.3.8, 17.6.6, 17.9.4
- cisco business_150ax_firmware 10.6.2.0
- cisco business_151axm_firmware 10.6.2.0
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L |
| NVD | 3.1 | 4.7 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L |
Affected products
- Cisco Cisco Aironet Access Point Software
- Cisco Cisco Aironet Access Point Software (IOS XE Controller)
- Cisco Cisco Business Wireless Access Point Software
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
Sources
- CVE List CVE-2023-20268
- NVD CVE-2023-20268
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.