PT-2026-27792 · Cisco · Cisco Ie3505 Rugged Series Switches+6
Published
2026-03-25
·
Updated
2026-04-23
·
CVE-2026-20104
CVSS v2.0
6.6
Medium
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches
Cisco Catalyst ESS9300 Embedded Series Switches
Cisco Catalyst IE9310 and IE9320 Rugged Series Switches
Cisco IE3500 and IE3505 Rugged Series Switches
Description
A flaw exists in the bootloader of the software that could allow a local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected device to execute arbitrary code during startup and compromise the chain of trust. This is due to inadequate software validation during the boot process. An attacker could exploit this by manipulating the loaded binaries on a device to bypass integrity checks performed during boot. A successful exploit could allow the attacker to execute code that circumvents the requirement for Cisco-signed images. Cisco has assigned a high Security Impact Rating (SIR) to this issue because it allows an attacker to bypass a major security feature of a device.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Catalyst 9200 Series Switches
Cisco Catalyst Ess9300 Embedded Series Switches
Cisco Catalyst Ie9310 Rugged Series Switches
Cisco Catalyst Ie9320 Rugged Series Switches
Cisco Ie3500 Rugged Series Switches
Cisco Ie3505 Rugged Series Switches
Cisco Ios Xe