PT-2020-5114 · Cisco · Cisco Ios Xe+1

Published 2020-09-24 · Updated 2025-08-22 · CVE-2020-3477

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS Software (affected versions not specified) Cisco IOS XE Software (affected versions not specified)

Description The issue is related to errors in processing input data in the CLI parser of Cisco IOS and Cisco IOS XE. It could allow an authenticated, local attacker to access files from the flash: filesystem due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this by using a specific command at the command line, potentially obtaining read-only access to files on the flash: filesystem that would otherwise be inaccessible.

Recommendations Update to a version of Cisco IOS Software that addresses this issue. Update to a version of Cisco IOS XE Software that addresses this issue. As a temporary workaround, consider restricting access to the flash: filesystem until a patch is available. Avoid using specific commands that could exploit this issue until the software is updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

BDU:2020-05710

CVE-2020-3477

Affected Products

Cisco Ios

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-3477 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3477 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05710 · Security Note