CVE-2020-3213: Cisco IOS XE Software Privilege Escalation Vulnerability

Published Jun 3, 2020

Updated

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot up. An attacker could exploit this vulnerability by sending parameters to the device at initial boot up. An exploit could allow the attacker to elevate from a Priv15 user to the root user and execute arbitrary commands with the privileges of the root user.

Affected Software

192 affected components

Cisco IOS XE=3.8.0s

Cisco IOS XE=3.8.1s

Cisco IOS XE=3.8.2s

Cisco IOS XE=3.9.0as

Cisco IOS XE=3.9.0s

Cisco IOS XE=3.9.1as

Cisco IOS XE=3.9.1s

Cisco IOS XE=3.9.2s

Cisco IOS XE=3.10.0s

Cisco IOS XE=3.10.1s

Cisco IOS XE=3.10.2as

Cisco IOS XE=3.10.2s

Cisco IOS XE=3.10.2ts

Cisco IOS XE=3.10.3s

Cisco IOS XE=3.10.4s

Cisco IOS XE=3.10.5s

Cisco IOS XE=3.10.6s

Cisco IOS XE=3.10.7s

Cisco IOS XE=3.10.8as

Cisco IOS XE=3.10.8s

Cisco IOS XE=3.10.9s

Cisco IOS XE=3.10.10s

Cisco IOS XE=3.11.0s

Cisco IOS XE=3.11.1s

Cisco IOS XE=3.11.2s

Cisco IOS XE=3.11.3s

Cisco IOS XE=3.11.4s

Cisco IOS XE=3.12.0as

Cisco IOS XE=3.12.0s

Cisco IOS XE=3.12.1s

Cisco IOS XE=3.12.2s

Cisco IOS XE=3.12.3s

Cisco IOS XE=3.12.4s

Cisco IOS XE=3.13.0as

Cisco IOS XE=3.13.0s

Cisco IOS XE=3.13.1s

Cisco IOS XE=3.13.2as

Cisco IOS XE=3.13.2s

Cisco IOS XE=3.13.3s

Cisco IOS XE=3.13.4s

Cisco IOS XE=3.13.5as

Cisco IOS XE=3.13.5s

Cisco IOS XE=3.13.6as

Cisco IOS XE=3.13.6bs

Cisco IOS XE=3.13.6s

Cisco IOS XE=3.13.7as

Cisco IOS XE=3.13.7s

Cisco IOS XE=3.13.8s

Cisco IOS XE=3.13.9s

Cisco IOS XE=3.13.10s

Cisco IOS XE=3.14.0s

Cisco IOS XE=3.14.1s

Cisco IOS XE=3.14.2s

Cisco IOS XE=3.14.3s

Cisco IOS XE=3.14.4s

Cisco IOS XE=3.15.0s

Cisco IOS XE=3.15.1cs

Cisco IOS XE=3.15.1s

Cisco IOS XE=3.15.2s

Cisco IOS XE=3.15.3s

Cisco IOS XE=3.15.4s

Cisco IOS XE=3.16.0as

Cisco IOS XE=3.16.0bs

Cisco IOS XE=3.16.0cs

Cisco IOS XE=3.16.0s

Cisco IOS XE=3.16.1as

Cisco IOS XE=3.16.2as

Cisco IOS XE=3.16.2bs

Cisco IOS XE=3.16.2s

Cisco IOS XE=3.16.3as

Cisco IOS XE=3.16.3s

Cisco IOS XE=3.16.4as

Cisco IOS XE=3.16.4bs

Cisco IOS XE=3.16.4cs

Cisco IOS XE=3.16.4ds

Cisco IOS XE=3.16.4es

Cisco IOS XE=3.16.4gs

Cisco IOS XE=3.16.4s

Cisco IOS XE=3.16.5as

Cisco IOS XE=3.16.5bs

Cisco IOS XE=3.16.5s

Cisco IOS XE=3.16.6bs

Cisco IOS XE=3.16.6s

Cisco IOS XE=3.16.7as

Cisco IOS XE=3.16.7bs

Cisco IOS XE=3.16.7s

Cisco IOS XE=3.16.8s

Cisco IOS XE=3.16.9s

Cisco IOS XE=3.16.10s

Cisco IOS XE=3.17.0s

Cisco IOS XE=3.17.1as

Cisco IOS XE=3.17.1s

Cisco IOS XE=3.17.2s

Cisco IOS XE=3.17.3s

Cisco IOS XE=3.17.4s

Cisco IOS XE=3.18.0s

Cisco IOS XE=3.18.0sp

Cisco IOS XE=3.18.1bsp

Cisco IOS XE=3.18.1csp

Cisco IOS XE=3.18.1gsp

Cisco IOS XE=3.18.1hsp

Cisco IOS XE=3.18.1isp

Cisco IOS XE=3.18.1s

Cisco IOS XE=3.18.1sp

Cisco IOS XE=3.18.2s

Cisco IOS XE=3.18.2sp

Cisco IOS XE=3.18.3s

Cisco IOS XE=3.18.3sp

Cisco IOS XE=3.18.4s

Cisco IOS XE=3.18.4sp

Cisco IOS XE=3.18.5sp

Cisco IOS XE=3.18.6sp

Cisco IOS XE=3.18.7sp

Cisco IOS XE=3.18.8sp

Cisco IOS XE=16.1.1

Cisco IOS XE=16.1.2

Cisco IOS XE=16.1.3

Cisco IOS XE=16.2.1

Cisco IOS XE=16.2.2

Cisco IOS XE=16.3.1

Cisco IOS XE=16.3.1a

Cisco IOS XE=16.3.2

Cisco IOS XE=16.3.3

Cisco IOS XE=16.3.4

Cisco IOS XE=16.3.5

Cisco IOS XE=16.3.5b

Cisco IOS XE=16.3.6

Cisco IOS XE=16.3.7

Cisco IOS XE=16.3.8

Cisco IOS XE=16.3.9

Cisco IOS XE=16.4.1

Cisco IOS XE=16.4.2

Cisco IOS XE=16.4.3

Cisco IOS XE=16.5.1

Cisco IOS XE=16.5.1a

Cisco IOS XE=16.5.1b

Cisco IOS XE=16.5.2

Cisco IOS XE=16.5.3

Cisco IOS XE=16.6.1

Cisco IOS XE=16.6.2

Cisco IOS XE=16.6.3

Cisco IOS XE=16.6.4

Cisco IOS XE=16.6.4a

Cisco IOS XE=16.6.4s

Cisco IOS XE=16.6.5

Cisco IOS XE=16.6.5a

Cisco IOS XE=16.6.5b

Cisco IOS XE=16.6.6

Cisco IOS XE=16.6.7

Cisco IOS XE=16.6.7a

Cisco IOS XE=16.7.1

Cisco IOS XE=16.7.2

Cisco IOS XE=16.7.3

Cisco IOS XE=16.8.1

Cisco IOS XE=16.8.1a

Cisco IOS XE=16.8.1b

Cisco IOS XE=16.8.1c

Cisco IOS XE=16.8.1s

Cisco IOS XE=16.8.2

Cisco IOS XE=16.8.3

Cisco IOS XE=16.9.1

Cisco IOS XE=16.9.1a

Cisco IOS XE=16.9.1b

Cisco IOS XE=16.9.1c

Cisco IOS XE=16.9.1d

Cisco IOS XE=16.9.1s

Cisco IOS XE=16.9.2

Cisco IOS XE=16.9.2a

Cisco IOS XE=16.9.2s

Cisco IOS XE=16.9.3

Cisco IOS XE=16.9.3a

Cisco IOS XE=16.9.3h

Cisco IOS XE=16.9.3s

Cisco IOS XE=16.9.4

Cisco IOS XE=16.9.4c

Cisco IOS XE=16.10.1

Cisco IOS XE=16.10.1a

Cisco IOS XE=16.10.1b

Cisco IOS XE=16.10.1e

Cisco IOS XE=16.10.1s

Cisco IOS XE=16.10.2

Cisco IOS XE=16.11.1

Cisco IOS XE=16.11.1a

Cisco IOS XE=16.11.1b

Cisco IOS XE=16.11.1c

Cisco IOS XE=16.11.1s

Cisco IOS XE=16.11.2

Cisco IOS XE=16.12.1

Cisco IOS XE=16.12.1a

Cisco IOS XE=16.12.1c

Cisco IOS XE=16.12.1s

Cisco IOS XE=16.12.1t

Remediation

Patch Available

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-priv-esc3-GMgnGCHx

Event History

Jun 3, 2020

CVE Published

via MITRE·05:41 PM

Data Sourced

via MITRE·05:41 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-3213?

The severity of CVE-2020-3213 is classified as high due to its potential to allow an attacker to elevate privileges to that of the root user.

How do I fix CVE-2020-3213?

To fix CVE-2020-3213, it is recommended to upgrade to a patched version of Cisco IOS XE Software.

Which versions of Cisco IOS XE are affected by CVE-2020-3213?

CVE-2020-3213 affects multiple versions of Cisco IOS XE, including 3.8.0s, 3.8.1s, 3.8.2s, and many later versions up to 16.12.1s.

Is CVE-2020-3213 remotely exploitable?

No, CVE-2020-3213 requires local authentication, meaning the attacker must have access to the device.

What potential impact does CVE-2020-3213 have on my device?

The impact of CVE-2020-3213 could lead to unauthorized access and execution of commands with root privileges, compromising the security of the device.