Exposed dangerous method or function in Cisco ASR 900 Series and Cisco IOS XE - CVE-2020-3513

Vulnerability identifier: #VU47213

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3513

CWE-ID: CWE-749

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code at bootup and break the chain of trust.

The vulnerability exists due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. A local administrator can copy a specific file to the local file system, define specific ROMMON variables and run arbitrary code on the system with root privileges.

Cisco ASR 900 Series
Cisco IOS XE

Install updates from vendor's website.

Cisco IOS XE - addressed in versions Amsterdam 17.1.2, Amsterdam 17.2.1, Amsterdam 17.2.1r, Amsterdam 17.3.1, Fuji 16.9.6, Gibraltar 16.12.4, 16.3.1, 16.3.2, 16.3.3, 16.3.4, 16.3.4a, 16.3.5, 16.3.5a, 16.3.5b, 16.3.9, 16.6.8, 16.9.5, 16.9.5.1, 16.9.6, 16.11.2, 16.12.1, 16.12.1s, 16.12.1y, 16.12.1z, 16.12.2, 16.12.2s, 16.12.3, 16.12.3s, 16.12.3a, 16.12.3.1, 16.12.4, 16.12.4a, 17.1.1, 17.1.1s, 17.1.1t, 17.1.2, 17.2.1, 17.2.1v, 17.2.1EFT, 17.2.1a, 17.2.1r, 17.2.2, 17.3.0.42, 17.3.1, 17.3.1EFT, 17.3.1a, 17.3.2EFT

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-rsp3-rce-jVHg8Z7c

• Multiple vulnerabilities in Cisco IOS XE Software for Cisco ASR 900 Series