Input validation error in Cisco Systems, Inc products - CVE-2020-3166
Published: February 27, 2020
Vulnerability identifier: #VU25656
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3166
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read or write arbitrary files on the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A local user can include specially crafted arguments to a specific CLI command and read or write to arbitrary files on the underlying OS.
This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco FXOS Software:
- Firepower 1000 Series
- Firepower 2100 Series
- Firepower 4100 Series
- Firepower 9300 Security Appliances
Affected software
Cisco FXOS
Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)
Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)
How to mitigate CVE-2020-3166
Install updates from vendor's website.
Cisco FXOS - addressed in versions 2.2.2.97, 2.3.1.155, 2.4.1.238, 2.6.1.157
Cisco Firewall Threat Defense (FTD) - update to 6.5.0.3
Cisco Adaptive Security Appliance (ASA) - update to 9.13.1.5
Cisco Firewall Threat Defense (FTD) - update to 6.5.0.3
Cisco Adaptive Security Appliance (ASA) - update to 9.13.1.5