CVE-2020-3207 — Command Injection in Cisco IOS XE Software 16.9.2

CWE-77 — Command InjectionCWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUMNVD
EPSS
0.2%
top 56.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE Software 16.9.2Cisco IOS XE
Timeline
PublishedJun 3
Latest updateMay 24

Description

A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell access to the underlying operating system (OS) to conduct a command injection attack during device boot. This vulnerability is due to insufficient input validation checks while processing boot options. An attacker could exploit this vulnerability by modifying device boot options to execute attacker-provided code. A successful exploit may allow …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/ios_xe19 versions+18

🔴Vulnerability Details

2
GHSA
GHSA-xjg8-5473-5pjp: A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root sh↗2022-05-24
▶
CVEList
Cisco IOS XE Software Command Injection Vulnerability↗2020-06-03
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software Command Injection Vulnerability↗2020-06-03
▶
CVE-2020-3207 — Command Injection in Cisco | cvebase