CVE-2020-3201 — Improper Input Validation in Cisco IOS 12.2 S

CWE-20 — Improper Input Validation5 documents5 sources
Severity
6.0MEDIUMNVD
EPSS
0.0%
top 90.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco IOS 12.2 SCisco IOSCisco IOS XE
Timeline
PublishedJun 3
Latest updateMay 24

Description

A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by executing crafted Tcl arguments on an affected device. An exploit could allow the attacker to caus…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HExploitability: 1.5 | Impact: 4.0

Affected Packages3 packages

▶NVDcisco/ios1670 versions+1669
▶NVDcisco/ios_xe247 versions+246
▶CVEListV5cisco/cisco_ios_12.2_sn/a

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-c4v9-f6pv-f763: A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local att↗2022-05-24
▶
CVEList
Cisco IOS and IOS XE Software Tcl Denial of Service Vulnerability↗2020-06-03
▶

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software Tcl Denial of Service Vulnerability↗2020-06-03
▶

💬Community

1
Bugzilla
CVE-2020-7237 cacti: remote code execution due to input validation in Performance Boost Debug Log↗2020-02-04
▶
CVE-2020-3201 — Improper Input Validation in Cisco | cvebase