Input validation error in Cisco IOS XE - CVE-2020-3218

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28762

Input validation error in Cisco IOS XE - CVE-2020-3218

Published: June 5, 2020


Vulnerability identifier: #VU28762
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3218
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the web UI. A remote administrator can first create a malicious file on the affected device itself, then upload a second malicious file to the device and execute arbitrary code on the target system.

This vulnerability affects the following products if they are running affected release of Cisco IOS XE Software: 

  • Cisco Catalyst 3850 Series Switches
  • Cisco Catalyst 3650 Series Switches
  • Cisco Catalyst 9300 Series Switches
  • Cisco Catalyst 9500 Series Switches
  • Cisco Catalyst 9200 Series Switches


Affected software

Cisco IOS XE
Stratix 5800

How to mitigate CVE-2020-3218

Install updates from vendor's website.

Cisco IOS XE - addressed in versions Amsterdam 17.1.1, Gibraltar 16.12.1b, Gibraltar 16.12.1c, Gibraltar 16.12.1d, Gibraltar 16.12.1e, Gibraltar 16.12.1s, 17.2.1
Stratix 5800 - update to 16.12.01

External References

Related Security Bulletins