CVE-2020-3284

published 2020-11-06

CVE-2020-3284: A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote…

Priority P2 65 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the management interface of hardware platforms that are running Cisco IOS XR Software only. The vulnerability exists because internal commands that are issued when the PXE network boot process is loading a software image are not properly verified. An attacker could exploit this vulnerability by compromising the PXE boot server and replacing a valid software image with a malicious one. Alternatively, the attacker could impersonate the PXE boot server and send a PXE boot reply with a malicious file. A successful exploit could allow the attacker to execute unsigned code on the affected device. Note: To fix this vulnerability, both the Cisco IOS XR Software and the BIOS must be upgraded. The BIOS code is included in Cisco IOS XR Software but might require additional installation steps. For further information, see the Fixed Software section of this advisory.

Affected

51 ranges · showing 25

Vendor	Product	Version range	Fixed in
cisco	a99-rp2-se_firmware	< 14.35	14.35
cisco	a99-rp2-tr_firmware	< 14.35	14.35
cisco	a99-rp3-se_firmware	< 30.23	30.23
cisco	a99-rp3-tr_firmware	< 30.23	30.23
cisco	a99-rsp-se_firmware	< 16.14	16.14
cisco	a99-rsp-tr_firmware	< 16.14	16.14
cisco	a9k-rsp5-se_firmware	< 31.20	31.20
cisco	a9k-rsp5-tr_firmware	< 31.20	31.20
cisco	a9k-rsp880-lt-se_firmware	< 17.34	17.34
cisco	a9k-rsp880-lt-tr_firmware	< 17.34	17.34
cisco	a9k-rsp880-se_firmware	< 10.65	10.65
cisco	a9k-rsp880-tr_firmware	< 10.65	10.65
cisco	asr-9901-rp_firmware	< 22.20	22.20
cisco	cisco_ios_xr_software	—	—
cisco	ios_xr	< 6.5.2	6.5.2
cisco	ios_xr	< 7.2.1	7.2.1
cisco	ios_xr	< 6.6.25	6.6.25
cisco	ios_xr	< 1.21	1.21
cisco	ios_xr	< 1.12	1.12
cisco	ios_xr	—	—
cisco	ios_xr	>= 7.0.0 < 7.0.2	7.0.2
cisco	n540-12z20g-sys-a_d_firmware	< 1.15	1.15
cisco	n540-24z8q2c-m_firmware	< 1.15	1.15
cisco	n540-28z4c-sys-a_d_firmware	< 1.15	1.15
cisco	n540-acc-sys_firmware	< 1.15	1.15

Detection & IOCs extracted from sources · hover to see the quote

• → Attacker may impersonate the PXE boot server and send a malicious PXE boot reply over the management interface — monitor for rogue DHCP/PXE (UDP port 67/68/69/4011) responses on the management network segment of Cisco IOS XR 64-bit hardware platforms. ↗
• → Attacker vector requires compromising or impersonating the PXE boot server to replace a valid software image — alert on unexpected TFTP (UDP 69) file transfers originating from non-authorised servers toward Cisco IOS XR management interfaces during boot. ↗
• → Exploitation is limited to the management interface — restrict and monitor Layer-2/Layer-3 access to the out-of-band management network for all Cisco IOS XR 64-bit hardware platforms to reduce attack surface. ↗
• → Both Cisco IOS XR Software AND the BIOS component must be upgraded to remediate; track Cisco Bug IDs CSCvi82550, CSCvq23340, and CSCvq31064 for patch status and verify BIOS upgrade completion on affected devices. ↗

• · No workarounds exist for this vulnerability; the only mitigation is patching both IOS XR Software and the BIOS. ↗
• · The BIOS upgrade is not automatic — it is bundled in IOS XR Software but may require explicit additional installation steps; devices may remain vulnerable even after an IOS XR software upgrade if the BIOS step is skipped. ↗
• · Vulnerability is only exploitable during the PXE network boot process — devices not configured to PXE-boot over the network are not exposed during normal operation, but exposure exists whenever a device is rebooted and PXE is the active boot method. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 8.1 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

vendor_cisco 8.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284