SB2020093097 - Arbitrary File Overwrite in Cisco IOS XE Software
Published: September 30, 2020
Security Bulletin ID
SB2020093097
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Files or Directories Accessible to External Parties (CVE-ID: CVE-2020-3476)
The vulnerability allows a local user to overwrite arbitrary files in the underlying host file system.
The vulnerability exists due to insufficient validation of the parameters of a specific CLI command. A local administrator can issue that command with specific parameters and overwrite the content of any arbitrary file that resides on the underlying host file system.
Remediation
Install update from vendor's website.