PT-2020-1988 · Cisco · Cisco Fxos+2

Published 2020-02-26 · Updated 2020-03-03 · CVE-2020-3171

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software (affected versions not specified) Cisco UCS Manager Software (affected versions not specified)

Description A vulnerability in the local management CLI of the affected software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The issue is due to insufficient input validation, allowing an attacker to exploit this vulnerability by including crafted arguments to specific commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in user, except on Cisco UCS 6400 Series Fabric Interconnects where the injected commands are executed with root privileges.

Recommendations For Cisco FXOS Software, update to a version that includes the fix for this issue. For Cisco UCS Manager Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the local management CLI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-01305

CVE-2020-3171

Affected Products

Cisco Asa

Cisco Fxos

Cisco Ucs Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-3171 · Security Note
• https://bdu.fstec.ru/vul/2020-01305 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-ucs-cli-cmdinj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3171 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-ucs-cli-cmdinj · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2020-3171 · Note