CVE-2020-3212: Cisco IOS XE Software Web UI Command Injection Vulnerability

Published Jun 3, 2020

Updated

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by uploading a crafted file to the web UI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands with root privileges on the device.

Affected Software

6 affected components

Cisco IOS XE=16.11.1

Cisco IOS XE=16.11.1a

Cisco IOS XE=16.11.1b

Cisco IOS XE=16.11.1c

Cisco IOS XE=16.11.1s

Cisco IOS XE=16.12.1y

Remediation

Patch Available

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj3-44st5CcA

Event History

Jun 3, 2020

CVE Published

via MITRE·05:41 PM

Data Sourced

via MITRE·05:41 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-3212?

CVE-2020-3212 is rated as critical due to its potential to allow remote attackers to execute arbitrary commands with root privileges.

How do I fix CVE-2020-3212?

To mitigate CVE-2020-3212, it is recommended to update Cisco IOS XE Software to the latest available versions that contain security patches.

Who is affected by CVE-2020-3212?

Users of Cisco IOS XE versions 16.11.1, 16.11.1a, 16.11.1b, 16.11.1c, 16.11.1s, and 16.12.1y may be affected by CVE-2020-3212.

What kind of attack does CVE-2020-3212 enable?

CVE-2020-3212 enables authenticated remote attackers to execute arbitrary commands with root privileges on affected devices.

Is CVE-2020-3212 part of a larger security issue?

CVE-2020-3212 is a standalone vulnerability but highlights the importance of input sanitization in web interfaces.