PT-2020-1992 · Cisco · Cisco Ucs 6400 Series Fabric Interconnects+3

Published 2020-02-26 · Updated 2023-08-15 · CVE-2020-3167

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software versions (affected versions not specified) Cisco UCS Manager Software versions (affected versions not specified)

Description The issue is related to insufficient input validation in the command-line interface of Cisco FXOS Software and Cisco UCS Manager Software. This could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user, or with root privileges on Cisco UCS 6400 Series Fabric Interconnects. An attacker could exploit this by including crafted arguments to specific commands.

Recommendations For Cisco FXOS Software, update to a version that includes the fix for this issue. For Cisco UCS Manager Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the command-line interface to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-01309

CVE-2020-3167

Affected Products

Cisco Asa

Cisco Fxos

Cisco Ucs 6400 Series Fabric Interconnects

Cisco Ucs Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-3167 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-ucs-cmdinj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01309 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-ucs-cmdinj · Vendor Advisory
• https://t.me/cvenotify/56499 · Telegram Post
• https://cxsecurity.com/cveshow/CVE-2020-3167 · Note