Read the docs
TI-2023-06908 Aliases CVE-2023-20202GHSA-9m3w-2ggj-2vqw

A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software…

Priority LOW 28CWE-789Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-789.

Summary

A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper memory management. An attacker could exploit this vulnerability by sending a series of network requests to an affected device. A successful exploit could allow the attacker to cause the wncd process to consume available memory and eventually cause the device to reload, resulting in a DoS condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco IOS XE Software17.10.1; 17.10.1a; 17.10.1b; 17.9.1; 17.9.1w; 17.9.2; 17.9.1a; 17.9.1x; 17.9.1y; 17.9.2a; 17.9.1x1—No fix listedCNA
  • Cisco IOS XE Software VendorCisco Affected 17.10.1; 17.10.1a; 17.10.1b; 17.9.1; 17.9.1w; 17.9.2; 17.9.1a; 17.9.1x; 17.9.1y; 17.9.2a; 17.9.1x1 Fixed in — No fix listed CNA

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*17.9.1VulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*17.9.1aVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*17.9.1wVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*17.9.1xVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*17.9.1x1VulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*17.9.1yVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*17.9.2VulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*17.9.2aVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.9.2b:*:*:*:*:*:*:*17.9.2bVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*17.10.1VulnerableCisco
  • cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:* Versions 17.9.1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:* Versions 17.9.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:* Versions 17.9.1w Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:* Versions 17.9.1x Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:* Versions 17.9.1x1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:* Versions 17.9.1y Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:* Versions 17.9.2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:* Versions 17.9.2a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.9.2b:*:*:*:*:*:*:* Versions 17.9.2b Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:* Versions 17.10.1 Vulnerable ·Cisco
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*17.10.1aVulnerableCisco
cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*17.10.1bVulnerableCisco
cpe:2.3:h:cisco:catalyst_9105i:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9105w:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9115:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9120:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9124d:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9124e:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9124i:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9130:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9136:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9162:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9164:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9166:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9166d1:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:catalyst_iw6300:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:esw6300:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:iw9167eh-x-ap:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:iw9167eh-x-urwb:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:iw9167eh-x-wgb:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:iw9167ih-x-ap:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:* Versions 17.10.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:* Versions 17.10.1b Vulnerable ·Cisco
  • cpe:2.3:h:cisco:catalyst_9105i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9105w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9115:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9124d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9124e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9124i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9136:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9162:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9164:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9166:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9166d1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:catalyst_iw6300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:esw6300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:iw9167eh-x-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:iw9167eh-x-urwb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:iw9167eh-x-wgb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:iw9167ih-x-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20202
  2. 2026-10-03 Alias added: GHSA-9m3w-2ggj-2vqw

References

Advisory 1

  • TI-2023-06904 Cisco is providing an update for the ongoing investigation into observed exploitation of… KEVCVSS 3.1CRITICAL 10.0
  • TI-2018-00122 Memory corruption in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-02977 Improper input validation in Cisco IOS and IOS XE Software KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
  • TI-2017-04498 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
  • TI-2017-04497 Memory corruption in Cisco IOS XE Software KEVCVSS 3.1HIGH 8.8
See all 561 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences