cisco-sa-ios-webui-priv-esc-K8zvEWM: Cisco IOS XE Software Privilege Escalation Vulnerabilities
First published: Thu Sep 24 2020(Updated: )
Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-webui-priv-esc-K8zvEWM This advisory is part of the September 24, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 25 Cisco Security Advisories that describe 34 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
Credit: Kwangho Park (panghoddari) KITRI BoB for findingreporting the vulnerability identified as CVE-2020-3425. The vulnerability identified as CVE-2020-3141 was found during internal security testing by P.W. the Cisco Advanced Security Initiatives Group
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-ios-webui-priv-esc-K8zvEWM?
The severity of cisco-sa-ios-webui-priv-esc-K8zvEWM is high due to the potential for privilege escalation.
How do I fix cisco-sa-ios-webui-priv-esc-K8zvEWM?
To fix cisco-sa-ios-webui-priv-esc-K8zvEWM, apply the latest security updates released by Cisco for affected IOS XE Software versions.
Who is affected by cisco-sa-ios-webui-priv-esc-K8zvEWM?
Organizations using affected versions of Cisco IOS XE Software with users having read-only privileges are at risk from cisco-sa-ios-webui-priv-esc-K8zvEWM.
What are the potential impacts of cisco-sa-ios-webui-priv-esc-K8zvEWM?
The potential impacts include unauthorized access to privileged functions and configurations on affected Cisco devices.
Is cisco-sa-ios-webui-priv-esc-K8zvEWM exploitable over the internet?
Yes, cisco-sa-ios-webui-priv-esc-K8zvEWM can be exploited by authenticated remote attackers over the internet.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/title
- agent/author
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe