PT-2020-2691 · Cisco · Cisco Ios Xe

Published 2020-06-03 · Updated 2021-09-17 · CVE-2020-3218

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-02759

CVE-2020-3218

Affected Products

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-3218 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3218 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02759 · Security Note