CVE-2020-3212: Cisco IOS XE Software Web UI Command Injection Vulnerability
First published: Wed Jun 03 2020(Updated: )
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by uploading a crafted file to the web UI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands with root privileges on the device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Web UI | =16.11.1 | |
| Cisco IOS XE Web UI | =16.11.1a | |
| Cisco IOS XE Web UI | =16.11.1b | |
| Cisco IOS XE Web UI | =16.11.1c | |
| Cisco IOS XE Web UI | =16.11.1s | |
| Cisco IOS XE Web UI | =16.12.1y |
Remedy
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj3-44st5CcA
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-3212?
CVE-2020-3212 is rated as critical due to its potential to allow remote attackers to execute arbitrary commands with root privileges.
How do I fix CVE-2020-3212?
To mitigate CVE-2020-3212, it is recommended to update Cisco IOS XE Software to the latest available versions that contain security patches.
Who is affected by CVE-2020-3212?
Users of Cisco IOS XE versions 16.11.1, 16.11.1a, 16.11.1b, 16.11.1c, 16.11.1s, and 16.12.1y may be affected by CVE-2020-3212.
What kind of attack does CVE-2020-3212 enable?
CVE-2020-3212 enables authenticated remote attackers to execute arbitrary commands with root privileges on affected devices.
Is CVE-2020-3212 part of a larger security issue?
CVE-2020-3212 is a standalone vulnerability but highlights the importance of input sanitization in web interfaces.
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/remedy
- agent/title
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe web ui
- version/cisco ios xe web ui/16.11.1
- version/cisco ios xe web ui/16.11.1a
- version/cisco ios xe web ui/16.11.1b
- version/cisco ios xe web ui/16.11.1c
- version/cisco ios xe web ui/16.11.1s
- version/cisco ios xe web ui/16.12.1y