CVE-2020-3216 — Improper Authentication in Cisco IOS XE Sd-wan Software

CWE-287 — Improper Authentication9 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 74.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE Sd-wan SoftwareCisco IOS XE Sd-wan
Timeline
PublishedJun 3
Latest updateMay 24

Description

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by stopping the boot initialization of an affected device. A successful exploit could allow the attacker to bypass authentication and gain unr…

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/ios_xe_sd-wan7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-vx84-h8r2-7438: A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted acces↗2022-05-24
▶
CVEList
Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability↗2020-06-03
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability↗2020-06-03
▶

💬Community

3
Bugzilla
CVE-2020-14311 grub2: Integer overflow in grub_ext2_read_link leads to heap-based buffer overflow↗2020-06-29
▶
Bugzilla
CVE-2020-14309 grub2: Integer overflow in grub_squash_read_symlink may lead to heap-based buffer overflow↗2020-06-29
▶
Bugzilla
CVE-2020-14310 grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow↗2020-06-29
▶
CVE-2020-3216 — Improper Authentication in Cisco | cvebase