Lucene search

K
cve[email protected]CVE-2020-3211
HistoryJun 03, 2020 - 6:15 p.m.

CVE-2020-3211

2020-06-0318:15:19
CWE-78
CWE-77
web.nvd.nist.gov
27
cisco
ios xe software
vulnerability
authenticated
remote attacker
command execution
input sanitization
nvd
cve-2020-3211

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

47.5%

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker who has valid administrative access to an affected device could exploit this vulnerability by supplying a crafted input parameter on a form in the web UI and then submitting that form. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device, which could lead to complete system compromise.

Affected configurations

NVD
Node
ciscoios_xeMatch16.10.1
OR
ciscoios_xeMatch16.10.1a
OR
ciscoios_xeMatch16.10.1b
OR
ciscoios_xeMatch16.10.1e
OR
ciscoios_xeMatch16.10.1s
OR
ciscoios_xeMatch16.10.2
OR
ciscoios_xeMatch16.11.1
OR
ciscoios_xeMatch16.11.1a
OR
ciscoios_xeMatch16.11.1b
OR
ciscoios_xeMatch16.11.1c
OR
ciscoios_xeMatch16.11.1s
OR
ciscoios_xeMatch16.12.1
OR
ciscoios_xeMatch16.12.1a
OR
ciscoios_xeMatch16.12.1c
OR
ciscoios_xeMatch16.12.1s
OR
ciscoios_xeMatch16.12.1t

CNA Affected

[
  {
    "product": "Cisco IOS XE Software 16.10.1",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

47.5%

Related for CVE-2020-3211