PT-2020-5075 · Cisco · Cisco Staros

Published 2020-10-07 · Updated 2020-10-16 · CVE-2020-3602

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco StarOS operating system for Cisco ASR 5000 Series Routers (affected versions not specified)

Description A vulnerability in the CLI of Cisco StarOS operating system could allow an authenticated, local attacker to elevate privileges on an affected device. The issue is due to insufficient input validation of CLI commands. An attacker could exploit this by sending crafted commands to the CLI, potentially allowing the execution of arbitrary code with the privileges of the root user. To exploit this, an attacker would need valid credentials and knowledge of the password for the cli test-commands command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

BDU:2020-05664

CVE-2020-3602

Affected Products

Cisco Staros

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-3602 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-privilege-esc-pyb7YTd · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3602 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05664 · Security Note
• https://t.me/cibsecurity/15140 · Telegram Post