CVE-2023-43017 is a high severity (CVSS 8.2) flaw in IBM Security Verify Access 10.0.0.0 through 10.0.6.1. A privileged user could install a configuration file that allows remote access. IBM's bulletin lists a fix package for the appliance, 10.0.7-ISS-ISVA-FP0000, and a newer container image for Docker.
What's affected
IBM's bulletin, first published January 9, 2024, names these products and versions as affected:
- IBM Security Verify Access Appliance: 10.0.0.0 through 10.0.6.1.
- IBM Security Verify Access Docker: 10.0.0.0 through 10.0.6.1.
The NVD record names only Security Verify Access and the 10.0.0.0 through 10.0.6.1 range, and IBM's text for this CVE says "IBM Security Verify Access". The Docker listing comes from the bulletin's affected product table.
IBM's remediation is the same as for the other CVEs in the bulletin: for Docker, pull the latest container image from icr.io/isva/verify-access, and for the appliance, install the fix 10.0.7-ISS-ISVA-FP0000. IBM lists no workarounds. The weakness is CWE-295, improper certificate validation.
How to check if you're exposed
For the appliance, read the firmware version in the management interface and compare it with the fixed 10.0.7 release. For Docker, list the images in use:
docker images icr.io/isva/verify-access
Then review who holds administrator rights on the product. The flaw needs a privileged user, so the list of those users defines who could use it. Check recent configuration imports for files you did not expect.
What to do now
- Inventory the appliances and containers and note each version.
- Apply IBM's fix package 10.0.7-ISS-ISVA-FP0000 to appliances, or pull the latest container image for Docker.
- Review the list of privileged accounts and remove any that are no longer needed.
- Require individual named accounts for administrators, with strong authentication.
- Review configuration change history for imports you cannot explain.
- Restrict management access to a dedicated administrative network.
Why it matters
The attacker here already needs high privileges. The vector in the record shows a local path, a high privilege requirement and a changed scope, with high impact on confidentiality, integrity and availability. In plain terms: an administrator, or someone who has taken over an administrator account, can install a configuration that opens remote access.
That makes the issue most relevant where administrative accounts are shared or weakly protected, or where an insider threat is part of the model. The class, CWE-295, is about trusting a certificate or identity that was not properly validated. The record's vector says AV:L, so this is not a flaw an outsider can use alone. The KEV flag is false.
Quick check
Can an outsider use this alone?
No. The record needs a privileged user and a local path. It matters most if administrator accounts are shared or can be taken over.
Sources
- IBM Security Bulletin: Multiple vulnerabilities in IBM Security Verify Access
- IBM X-Force Exchange entry 266155 (referenced in the record; content did not load when fetched)
Last reviewed: 19 October 2026.
