PT-2020-2674 · Cisco · Cisco Ios Xe

Published 2020-06-03 · Updated 2020-06-10 · CVE-2020-3211

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to improper input sanitization in the web UI of Cisco IOS XE Software, allowing an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. This could lead to complete system compromise. An attacker with valid administrative access to an affected device could exploit this by supplying a crafted input parameter on a form in the web UI and then submitting that form.

Recommendations For Cisco IOS XE Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but it is recommended to check the Cisco Security Advisory for the latest information on affected and fixed versions. As a temporary workaround, consider restricting access to the web UI to minimize the risk of exploitation.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2020-02741

CVE-2020-3211

Affected Products

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-3211 · Security Note
• https://bdu.fstec.ru/vul/2020-02741 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj4-S2TmH7GA · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3211 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj4-S2TmH7GA · Vendor Advisory