OS Command Injection in Cisco Systems, Inc products - CVE-2020-3454
Published: August 27, 2020
Vulnerability identifier: #VU46108
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3454
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation of specific Call Home configuration parameters when the software is configured for transport method HTTP. A remote administrator can modify parameters within the Call Home configuration and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cisco NX-OS
Cisco Nexus 3000 Series Switches
Cisco Nexus 5500 Series Switches
Cisco Nexus 5600 Series Switches
Cisco Nexus 6000 Series Switches
Cisco Nexus 9000 Series Switches NX-OS Mode
Cisco Nexus 3600 Platform Switches
Cisco Nexus 9500 R-Series
Cisco Nexus 7000 Series Switches
Cisco MDS 9000 Series Multilayer Switches
Cisco Nexus 3000 Series Switches
Cisco Nexus 5500 Series Switches
Cisco Nexus 5600 Series Switches
Cisco Nexus 6000 Series Switches
Cisco Nexus 9000 Series Switches NX-OS Mode
Cisco Nexus 3600 Platform Switches
Cisco Nexus 9500 R-Series
Cisco Nexus 7000 Series Switches
Cisco MDS 9000 Series Multilayer Switches
How to mitigate CVE-2020-3454
Install updates from vendor's website.
Cisco Nexus 3000 Series Switches - addressed in versions 6.0.2 A8.10, 7.0.3 I4.8, 7.0.3 I7.2, 7.0.3 I7.7, 9.2.1
Cisco Nexus 5500 Series Switches - addressed in versions 7.1.5 N1.1b, 7.3.3 D1.1, 7.3.3 N1.1
Cisco Nexus 5600 Series Switches - addressed in versions 7.1.5 N1.1b, 7.3.3 D1.1, 7.3.3 N1.1
Cisco Nexus 6000 Series Switches - addressed in versions 7.1.5 N1.1b, 7.3.3 D1.1, 7.3.3 N1.1
Cisco Nexus 9000 Series Switches NX-OS Mode - addressed in versions 6.0.2 A8.10, 7.0.3 I4.8, 7.0.3 I7.2, 7.0.3 I7.7, 9.2.1
Cisco Nexus 3600 Platform Switches - update to 7.0.3 F3.3
Cisco Nexus 9500 R-Series - update to 7.0.3 F3.3
Cisco Nexus 7000 Series Switches - addressed in versions 6.2.25, 7.3.4 D1.1, 8.2.3, 8.3.1
Cisco Nexus 5500 Series Switches - addressed in versions 7.1.5 N1.1b, 7.3.3 D1.1, 7.3.3 N1.1
Cisco Nexus 5600 Series Switches - addressed in versions 7.1.5 N1.1b, 7.3.3 D1.1, 7.3.3 N1.1
Cisco Nexus 6000 Series Switches - addressed in versions 7.1.5 N1.1b, 7.3.3 D1.1, 7.3.3 N1.1
Cisco Nexus 9000 Series Switches NX-OS Mode - addressed in versions 6.0.2 A8.10, 7.0.3 I4.8, 7.0.3 I7.2, 7.0.3 I7.7, 9.2.1
Cisco Nexus 3600 Platform Switches - update to 7.0.3 F3.3
Cisco Nexus 9500 R-Series - update to 7.0.3 F3.3
Cisco Nexus 7000 Series Switches - addressed in versions 6.2.25, 7.3.4 D1.1, 8.2.3, 8.3.1