Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2020-3210

Опубликовано: 03 июн. 2020
Источник: nvd
CVSS3: 6.7
CVSS3: 6.7
CVSS2: 7.2
EPSS Низкий

Описание

A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated, local attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The attacker must have valid user credentials at privilege level 15. The vulnerability is due to insufficient validation of arguments that are passed to specific VDS-related CLI commands. An attacker could exploit this vulnerability by authenticating to the targeted device and including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user.

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:cisco:ios:12.2\(60\)ez16:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:15.0\(2\)sg11a:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:15.3\(3\)jaa1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:15.3\(3\)jpj:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:15.9\(3\)m:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:15.9\(3\)m0a:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:cisco:1120:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1240:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:809:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:829:*:*:*:*:*:*:*:*

EPSS

Процентиль: 14%
0.00047
Низкий

6.7 Medium

CVSS3

6.7 Medium

CVSS3

7.2 High

CVSS2

Дефекты

CWE-77
CWE-78

Связанные уязвимости

CVSS3: 6.7
github
больше 3 лет назад

A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated, local attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The attacker must have valid user credentials at privilege level 15. The vulnerability is due to insufficient validation of arguments that are passed to specific VDS-related CLI commands. An attacker could exploit this vulnerability by authenticating to the targeted device and including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user.

CVSS3: 6.7
fstec
больше 5 лет назад

Уязвимость компонента CLI операционной системы Cisco IOS, связанная с непринятием мер по чистке данных на управляющем уровне, позволяющая нарушителю получить доступ к системе и выполнять произвольные команды с привилегиями root

EPSS

Процентиль: 14%
0.00047
Низкий

6.7 Medium

CVSS3

6.7 Medium

CVSS3

7.2 High

CVSS2

Дефекты

CWE-77
CWE-78