PT-2020-2684 · Cisco · Cisco Ios Xe Web Management+1

Published 2020-06-03 · Updated 2020-06-09 · CVE-2020-3229

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Web Management Software (affected versions not specified)

Description A vulnerability in the Role Based Access Control (RBAC) functionality could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The issue is due to incorrect handling of RBAC for the administration GUI. An attacker could exploit this by sending a modified HTTP request to the affected device, potentially allowing a Read-Only user to execute CLI commands or configuration changes as if they were an Admin user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-264

Related Identifiers

BDU:2020-02751

CVE-2020-3229

Affected Products

Cisco Ios Xe Web Management

Cisco Ios Xe

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-PZgQxjfG · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3229 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-PZgQxjfG · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3229 · Security Note
• https://bdu.fstec.ru/vul/2020-02751 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/654300 · Security Note
• https://t.me/cvenotify/4150 · Telegram Post