PT-2020-4663 · Cisco · Cisco Edge Fog Fabric

Published 2020-11-04 · Updated 2020-11-19 · CVE-2020-26084

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Edge Fog Fabric (affected versions not specified)

Description A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected system. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2020-05215

CVE-2020-26084

Affected Products

Cisco Edge Fog Fabric

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-eff-incperm-9E6h4yBz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26084 · Security Note
• https://bdu.fstec.ru/vul/2020-05215 · Security Note
• https://t.me/cibsecurity/15997 · Telegram Post
• https://t.me/cvenotify/5273 · Telegram Post