CVE-2020-3387

CWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGH
EPSS
39.2%
top 2.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Sd-wan FirmwareCisco Cisco Sd-wan Vmanage
Timeline
PublishedJul 16
Latest updateMay 24

Description

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The vulnerability is due to insufficient input sanitization during user authentication processing. An attacker could exploit this vulnerability by sending a crafted response to the Cisco SD-WAN vManage Software. A successful exploit could allow the attacker to access the software and execute commands they should not be authorized to execute.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/sd-wan_firmware18.4.0 — 19.2.3+2

🔴Vulnerability Details

2
GHSA
GHSA-858r-5xm4-gf36: A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected sys↗2022-05-24
▶
CVEList
Cisco SD-WAN vManage Software Remote Code Execution Vulnerability↗2020-07-16
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN vManage Software Remote Code Execution Vulnerability↗2020-07-15
▶
CVE-2020-3387 (HIGH CVSS 8.8) | A vulnerability in Cisco SD-WAN vMa | cvebase.io