PT-2020-3772 · Cisco · Cisco Smart Software Manager On-Prem

Published 2020-08-19 · Updated 2020-09-02 · CVE-2020-3443

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Smart Software Manager On-Prem (affected versions not specified)

Description: A vulnerability in Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges and execute commands with higher privileges. The issue is due to insufficient authorization of the System Operator role capabilities. An attacker could exploit this by logging in with the System Operator role, performing a series of actions, and then assuming a new higher privileged role. A successful exploit could allow the attacker to perform all actions associated with the privilege of the assumed role, potentially gaining full access to the device if the assumed role is administrative.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

BDU:2020-04132

CVE-2020-3443

Affected Products

Cisco Smart Software Manager On-Prem

References · 4

• https://bdu.fstec.ru/vul/2020-04132 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3443 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smart-priv-esca-nqwxXWBu · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3443 · Vendor Advisory