CVE-2020-3403
Severity CVSS v4.0:
Pending analysis
Type:
CWE-78
OS Command Injections
Publication date:
24/09/2020
Last modified:
27/10/2022
Description
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device. The authenticated user must have privileged EXEC permissions on the device. The vulnerability is due to insufficient protection of values passed to a script that executes during device startup. An attacker could exploit this vulnerability by writing values to a specific file. A successful exploit could allow the attacker to execute commands with root privileges each time the affected device is restarted.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Base Score 2.0
7.20
Severity 2.0
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:* | ||
| cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:* | ||
| cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page