PT-2020-2795 · Cisco+1 · Cisco Ios Xe+2

Published 2020-06-03 · Updated 2021-08-12 · CVE-2020-3201

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Tool Command Language (Tcl) interpreter could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. The issue is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this by executing crafted Tcl arguments on an affected device, potentially causing the device to reload and resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-02890

CVE-2020-3201

Affected Products

Cisco Ios

Cisco Ios Xe

Tcl

References · 5

• https://bdu.fstec.ru/vul/2020-02890 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tcl-dos-MAZQUnMF · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tcl-dos-MAZQUnMF · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3201 · Security Note