PT-2020-20116 · Cisco · Cnos

Published 2020-10-14 · Updated 2020-10-29 · CVE-2020-8349

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Networking Operating System (CNOS) (affected versions not specified)

Description An unauthenticated remote code execution issue has been identified in the optional REST API management interface of Cloud Networking Operating System (CNOS). This interface is disabled by default and is only vulnerable when enabled, specifically when attached to a VRF and as allowed by defined ACLs.

Recommendations For all affected versions, upgrade to a non-vulnerable CNOS release. As a temporary workaround, consider disabling the REST API management interface until a patch is available. Restrict access to the management VRF and further limit access to authorized management stations via ACL.

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2020-8349

Affected Products

Cnos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-8349 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8349 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-44423 · Vendor Advisory