PT-2020-2896 · Cisco · Cisco Ios Xe Sd-Wan

Published 2020-06-03 · Updated 2020-06-10 · CVE-2020-3216

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE SD-WAN Software (affected versions not specified)

Description A vulnerability exists due to insufficient authentication mechanisms for certain commands, allowing an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The issue can be exploited by stopping the boot initialization of the device, potentially giving the attacker full control over the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2020-03053

CVE-2020-3216

Affected Products

Cisco Ios Xe Sd-Wan

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-auth-b-NzwhJHH7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3216 · Security Note
• https://bdu.fstec.ru/vul/2020-03053 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3216 · Vendor Advisory