PT-2020-5089 · Cisco · Cisco Ios Xe

Kwangho Park + 1 · Published 2020-09-24 · Updated 2023-05-22 · CVE-2020-3475

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the web management framework of Cisco IOS XE Software. These vulnerabilities could allow an authenticated, remote attacker with read-only privileges to gain unauthorized read access to sensitive data or cause the web management software to hang or crash, resulting in a denial of service (DoS) condition. The vulnerabilities are associated with errors in processing input data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Privilege Management

RCE

Weakness Enumeration

CWE-269

CWE-20

Related Identifiers

BDU:2020-05680

CVE-2020-3475

Affected Products

Cisco Ios Xe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3475 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-webui-multi-vfTkk7yr · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05680 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-webui-multi-vfTkk7yr · Vendor Advisory