PT-2020-5052 · Cisco · Cisco Ios Xe

Published 2020-09-24 · Updated 2023-05-22 · CVE-2020-3423

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to insufficient restrictions on Lua function calls within the context of user-supplied Lua scripts in the Lua interpreter integrated in Cisco IOS XE Software. This could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. An attacker with valid administrative credentials could exploit this by submitting a malicious Lua script, potentially leading to a buffer overflow condition. A successful exploit could allow the attacker to execute arbitrary code with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2020-05639

CVE-2020-3423

Affected Products

Cisco Ios Xe

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lua-rce-7VeJX4f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3423 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lua-rce-7VeJX4f · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05639 · Security Note