CVE-2020-3403: Cisco IOS XE Software Command Injection Vulnerability
First published: Thu Sep 24 2020(Updated: )
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device. The authenticated user must have privileged EXEC permissions on the device. The vulnerability is due to insufficient protection of values passed to a script that executes during device startup. An attacker could exploit this vulnerability by writing values to a specific file. A successful exploit could allow the attacker to execute commands with root privileges each time the affected device is restarted.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =17.2.1 | |
| Cisco Catalyst 9800-40 | ||
| Cisco Catalyst 9800-80 | ||
| Cisco Catalyst 9800-cl | ||
| Cisco Catalyst 9800-l | ||
| Cisco Catalyst 9800-l-c | ||
| Cisco Catalyst 9800-l-f |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2020-3403.
What is the severity rating of CVE-2020-3403?
The severity rating of CVE-2020-3403 is high.
What is the affected software?
The affected software is Cisco IOS XE 17.2.1.
How can an attacker exploit CVE-2020-3403?
An authenticated, local attacker with privileged EXEC permissions can inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device.
How can I fix CVE-2020-3403?
Apply the necessary security patches or updates provided by Cisco.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/17.2.1
- canonical/cisco catalyst 9800-40
- canonical/cisco catalyst 9800-80
- canonical/cisco catalyst 9800-cl
- canonical/cisco catalyst 9800-l
- canonical/cisco catalyst 9800-l-c
- canonical/cisco catalyst 9800-l-f