#VU34078 Improper access control in Cisco Cyber Vision Center - CVE-2020-3448

Vulnerability identifier: #VU34078

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-3448

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Cyber Vision Center
Server applications / Server solutions for antivurus protection

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can directly access the internal services of an affected device and have impact on monitoring of sensors that are managed by the software.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cisco Cyber Vision Center: before 3.0.4

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvc-bypass-K99Cb2ff

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.