CVE-2020-3297

published 2020-07-02

CVE-2020-3297: A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote…

Priority P2 64 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device. The vulnerability is due to the use of weak entropy generation for session identifier values. An attacker could exploit this vulnerability to determine a current session identifier through brute force and reuse that session identifier to take over an ongoing session. In this way, an attacker could take actions within the management interface with privileges up to the level of the administrative user.

Affected

59 ranges · showing 25

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_200_series_smart_switches	—	—
cisco	sf250-24_firmware	< 2.5.5.47	2.5.5.47
cisco	sf250-24p_firmware	< 2.5.5.47	2.5.5.47
cisco	sf250-48_firmware	< 2.5.5.47	2.5.5.47
cisco	sf250-48hp_firmware	< 2.5.5.47	2.5.5.47
cisco	sf350-48_firmware	< 2.5.5.47	2.5.5.47
cisco	sf350-48mp_firmware	< 2.5.5.47	2.5.5.47
cisco	sf350-48p_firmware	< 2.5.5.47	2.5.5.47
cisco	sf550x-24_firmware	< 2.5.5.47	2.5.5.47
cisco	sf550x-24mp_firmware	< 2.5.5.47	2.5.5.47
cisco	sf550x-24p_firmware	< 2.5.5.47	2.5.5.47
cisco	sf550x-48_firmware	< 2.5.5.47	2.5.5.47
cisco	sf550x-48mp_firmware	< 2.5.5.47	2.5.5.47
cisco	sf550x-48p_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-08_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-08hp_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-10p_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-18_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-26_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-26hp_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-26p_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-50_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-50hp_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250-50p_firmware	< 2.5.5.47	2.5.5.47
cisco	sg250x-24_firmware	< 2.5.5.47	2.5.5.47

Detection & IOCs extracted from sources · hover to see the quote

• → Detect brute-force attempts against the web management interface session identifier — monitor for high volumes of requests with varying session cookie/token values from a single source IP targeting the switch management interface. ↗
• → Alert on unauthenticated access to the management interface of Cisco Small Business Smart and Managed Switches, particularly where session identifiers are reused from a previously unauthenticated source. ↗
• → Track Cisco bug ID CSCvt53117 for patch status; unpatched devices remain exploitable via session ID prediction. ↗

• · Devices that have reached end of software maintenance will not receive patches and remain permanently vulnerable. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 8.1 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

vendor_cisco 8.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287