CVE-2020-3396: Cisco IOS XE Software IOx Guest Shell USB SSD Namespace Protection Privilege Escalation Vulnerability
First published: Thu Sep 24 2020(Updated: )
A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =16.12.1 | |
| Cisco 1100-4g Integrated Services Router | ||
| Cisco 1100-4gltegb Integrated Services Router | ||
| Cisco 1100-4gltena Integrated Services Router | ||
| Cisco 1100-6g Integrated Services Router | ||
| Cisco 1100-lte Integrated Services Router | ||
| Cisco 1100 Integrated Services Router | ||
| Cisco 4321\/k9-rf Integrated Services Router | ||
| Cisco 4321\/k9-ws Integrated Services Router | ||
| Cisco 4321\/k9 Integrated Services Router | ||
| Cisco 4331\/k9-rf Integrated Services Router | ||
| Cisco 4331\/k9-ws Integrated Services Router | ||
| Cisco 4331\/k9 Integrated Services Router | ||
| Cisco 4351\/k9-rf Integrated Services Router | ||
| Cisco 4351\/k9-ws Integrated Services Router | ||
| Cisco 4351\/k9 Integrated Services Router | ||
| Cisco Asr 1000-x | ||
| Cisco Asr 1001 | ||
| Cisco Asr 1001-x | ||
| Cisco Asr 1002 | ||
| Cisco Asr 1002-x | ||
| Cisco Asr 1004 | ||
| Cisco Asr 1006 | ||
| Cisco Asr 1013 | ||
| Cisco Asr 1023 | ||
| Cisco Catalyst C9300-24p | ||
| Cisco Catalyst C9300-24s | ||
| Cisco Catalyst C9300-24t | ||
| Cisco Catalyst C9300-24u | ||
| Cisco Catalyst C9300-24ux | ||
| Cisco Catalyst C9300-48p | ||
| Cisco Catalyst C9300-48s | ||
| Cisco Catalyst C9300-48t | ||
| Cisco Catalyst C9300-48u | ||
| Cisco Catalyst C9300-48un | ||
| Cisco Catalyst C9300-48uxm | ||
| Cisco Catalyst C9300l-24p-4g | ||
| Cisco Catalyst C9300l-24p-4x | ||
| Cisco Catalyst C9300l-24t-4g | ||
| Cisco Catalyst C9300l-24t-4x | ||
| Cisco Catalyst C9300l-48p-4g | ||
| Cisco Catalyst C9300l-48p-4x | ||
| Cisco Catalyst C9300l-48t-4g | ||
| Cisco Catalyst C9300l-48t-4x | ||
| Cisco Catalyst C9404r | ||
| Cisco Catalyst C9407r | ||
| Cisco Catalyst C9410r | ||
| Cisco Catalyst C9500-12q | ||
| Cisco Catalyst C9500-16x | ||
| Cisco Catalyst C9500-24q | ||
| Cisco Catalyst C9500-24y4c | ||
| Cisco Catalyst C9500-32c | ||
| Cisco Catalyst C9500-32qc | ||
| Cisco Catalyst C9500-40x | ||
| Cisco Catalyst C9500-48y4c | ||
| Cisco Csr1000v |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-3396?
CVE-2020-3396 is a vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software.
How does CVE-2020-3396 work?
CVE-2020-3396 allows an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system.
What is the severity of CVE-2020-3396?
The severity of CVE-2020-3396 is high, with a severity value of 7.2.
How do I fix CVE-2020-3396?
To fix CVE-2020-3396, it is recommended to apply the necessary patches and updates provided by Cisco.
Where can I find more information about CVE-2020-3396?
You can find more information about CVE-2020-3396 on the Cisco Security Advisory page: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/title
- agent/last-modified-date
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/16.12.1
- canonical/cisco 1100-4g integrated services router
- canonical/cisco 1100-4gltegb integrated services router
- canonical/cisco 1100-4gltena integrated services router
- canonical/cisco 1100-6g integrated services router
- canonical/cisco 1100-lte integrated services router
- canonical/cisco 1100 integrated services router
- canonical/cisco 4321\/k9-rf integrated services router
- canonical/cisco 4321\/k9-ws integrated services router
- canonical/cisco 4321\/k9 integrated services router
- canonical/cisco 4331\/k9-rf integrated services router
- canonical/cisco 4331\/k9-ws integrated services router
- canonical/cisco 4331\/k9 integrated services router
- canonical/cisco 4351\/k9-rf integrated services router
- canonical/cisco 4351\/k9-ws integrated services router
- canonical/cisco 4351\/k9 integrated services router
- canonical/cisco asr 1000-x
- canonical/cisco asr 1001
- canonical/cisco asr 1001-x
- canonical/cisco asr 1002
- canonical/cisco asr 1002-x
- canonical/cisco asr 1004
- canonical/cisco asr 1006
- canonical/cisco asr 1013
- canonical/cisco asr 1023
- canonical/cisco catalyst c9300-24p
- canonical/cisco catalyst c9300-24s
- canonical/cisco catalyst c9300-24t
- canonical/cisco catalyst c9300-24u
- canonical/cisco catalyst c9300-24ux
- canonical/cisco catalyst c9300-48p
- canonical/cisco catalyst c9300-48s
- canonical/cisco catalyst c9300-48t
- canonical/cisco catalyst c9300-48u
- canonical/cisco catalyst c9300-48un
- canonical/cisco catalyst c9300-48uxm
- canonical/cisco catalyst c9300l-24p-4g
- canonical/cisco catalyst c9300l-24p-4x
- canonical/cisco catalyst c9300l-24t-4g
- canonical/cisco catalyst c9300l-24t-4x
- canonical/cisco catalyst c9300l-48p-4g
- canonical/cisco catalyst c9300l-48p-4x
- canonical/cisco catalyst c9300l-48t-4g
- canonical/cisco catalyst c9300l-48t-4x
- canonical/cisco catalyst c9404r
- canonical/cisco catalyst c9407r
- canonical/cisco catalyst c9410r
- canonical/cisco catalyst c9500-12q
- canonical/cisco catalyst c9500-16x
- canonical/cisco catalyst c9500-24q
- canonical/cisco catalyst c9500-24y4c
- canonical/cisco catalyst c9500-32c
- canonical/cisco catalyst c9500-32qc
- canonical/cisco catalyst c9500-40x
- canonical/cisco catalyst c9500-48y4c
- canonical/cisco csr1000v