CVE-2020-3224: Cisco IOS XE Software Web UI Command Injection Vulnerability
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The vulnerability is due to insufficient input validation of specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific web UI endpoint on an affected device. A successful exploit could allow the attacker to inject IOS commands to the affected device, which could allow the attacker to alter the configuration of the device or cause a denial of service (DoS) condition.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-3224?
CVE-2020-3224 has been rated as a high severity vulnerability due to the potential for command injection by an authenticated user.
How do I fix CVE-2020-3224?
To mitigate CVE-2020-3224, update your Cisco IOS XE Software to the latest version available that addresses this vulnerability.
Who is affected by CVE-2020-3224?
CVE-2020-3224 affects devices running specific versions of Cisco IOS XE Software including 16.11.1 and its subsequent releases.
What are the potential impacts of CVE-2020-3224?
Exploitation of CVE-2020-3224 could allow an authenticated attacker to execute unauthorized commands on the device.
Is there a workaround for CVE-2020-3224?
Currently, there are no specific workarounds for CVE-2020-3224 other than applying the necessary software updates.