PT-2020-2693 · Cisco · Cisco Ios Xe

Published 2020-06-03 · Updated 2020-06-10 · CVE-2020-3209

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to errors in cryptographic signature verification during the initial boot process of system image files. This could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. An attacker could exploit this by loading unsigned software on the device. A successful exploit could allow the attacker to install and boot a malicious software image or execute unsigned binaries on the targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2020-02761

CVE-2020-3209

Affected Products

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-3209 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-digsig-bypass-FYQ3bmVq · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-digsig-bypass-FYQ3bmVq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3209 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02761 · Security Note