PT-2020-2960 · Cisco · Cisco Ios Xr

Published 2020-06-17 · Updated 2020-06-24 · CVE-2020-3364

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description A vulnerability in the access control list (ACL) functionality of the standby route processor management interface could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management interface. The issue is due to a logic error that prevents the ACL from working when applied against the standby route processor management interface. An attacker could exploit this by attempting to access the device through the standby route processor management interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

BDU:2020-03117

CVE-2020-3364

Affected Products

Cisco Ios Xr

References · 4

• https://osv.dev/vulnerability/CVE-2020-3364 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xracl-zbWSWREt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3364 · Security Note
• https://bdu.fstec.ru/vul/2020-03117 · Security Note