PT-2020-5223 · Cisco · Cisco Vision Dynamic Signage Director

Published 2020-08-19 · Updated 2020-09-09 · CVE-2020-3485

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Vision Dynamic Signage Director (affected versions not specified)

Description The issue is related to errors in access control management in the role-based access control (RBAC) functionality of the system. This could allow a remote attacker to gain access to resources they should not be able to access and perform actions they should not be able to perform. The vulnerability exists due to improper handling of RBAC by the web management software. An attacker could exploit this by sending a crafted HTTP request to an affected device, potentially allowing them to view and delete certain screen content on the system that they would not normally have privileges to access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-264

Related Identifiers

BDU:2020-05855

CVE-2020-3485

Affected Products

Cisco Vision Dynamic Signage Director

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvdsd-rbac-y9LM5jw4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05855 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3485 · Security Note