Main Vulnerability Database Vulnerabilities #VU25781

Command Injection in Cisco Systems, Inc products - CVE-2020-3176

Published: March 5, 2020

Vulnerability identifier: #VU25781

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3176

CWE-ID: CWE-77

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary commands on the system.

The vulnerability exists due to improper sanitization of user-supplied input. A local administrator can supply certain CLI commands with crafted arguments and run arbitrary commands on the target system.

Affected software

Cisco Remote PHY 120
Cisco Remote PHY 220
Cisco Remote PHY Shelf 7200

How to mitigate CVE-2020-3176

Install updates from vendor's website.

Cisco Remote PHY 120 - update to 7.7

External References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rphy-cmdinject-DpEjeTgF

Related Security Bulletins