CVE-2020-3595: Cisco SD-WAN Software Privilege Escalation Vulnerability
First published: Fri Nov 06 2020(Updated: )
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root group on the underlying operating system. The vulnerability is due to incorrect permissions being set when the affected command is executed. An attacker could exploit this vulnerability by executing the affected command on an affected system. A successful exploit could allow the attacker to gain root privileges.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN | <20.1.2 | |
| Cisco SD-WAN | >=20.3<20.3.2 |
Remedy
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepegr-4xynYLUj
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Cisco SD-WAN Software vulnerability?
The vulnerability ID of this Cisco SD-WAN Software vulnerability is CVE-2020-3595.
How severe is CVE-2020-3595?
CVE-2020-3595 has a severity score of 7.8 out of 10, which is considered high.
How does this vulnerability allow privilege escalation?
This vulnerability allows an authenticated, local attacker to elevate privileges to the root group on the underlying operating system due to incorrect permissions being set when the affected command is executed.
Which versions of Cisco SD-WAN Software are affected by CVE-2020-3595?
CVE-2020-3595 affects Cisco SD-WAN Software versions 20.1.2 up to exclusive and versions 20.3 up to exclusive (up to version 20.3.2).
Is there a fix available for CVE-2020-3595?
Yes, Cisco has released a security advisory with patches and mitigations for CVE-2020-3595. Please refer to the following link for more information: [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepegr-4xynYLUj)
- collector/nvd-index
- agent/type
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/author
- agent/last-modified-date
- agent/tags
- agent/references
- agent/severity
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/description
- vendor/cisco
- canonical/cisco sd-wan
- version/cisco sd-wan/20.3