CVE-2020-3138 Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability

2020-02-1919:15:58

CWE-347

cisco

www.cve.org

EPSS

Percentile

5.1%

JSON

A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to upload crafted code to the affected device.

CNA Affected

[
  {
    "product": "NA",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-codex-shs4NhvS

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2020-3138