CVE-2020-3448
published 2020-08-17CVE-2020-3448: A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication…
PriorityP434medium5.8CVSS 3.1
AVNACLPRNUINSCCNILAN
EPSS
1.11%
62.1th percentile
A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication and access internal services that are running on an affected device. The vulnerability is due to insufficient enforcement of access control in the software. An attacker could exploit this vulnerability by directly accessing the internal services of an affected device. A successful exploit could allow an attacker to impact monitoring of sensors that are managed by the software.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_cyber_vision | — | — |
| cisco | cyber_vision_center | < 3.0.4 | 3.0.4 |
| cisco | cyber_vision_center | — | — |
CVSS provenance
nvdv3.15.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
nvdv3.05.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Cyber Vision Center Software Access Control Bypass Vulnerability
vendor_cisco·2020-08-05·CVSS 5.8
CVE-2020-3448 [MEDIUM] CWE-284 Cisco Cyber Vision Center Software Access Control Bypass Vulnerability
Cisco Cyber Vision Center Software Access Control Bypass Vulnerability
A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication and access internal services that are running on an affected device.
The vulnerability is due to insufficient enforcement of access control in the software. An attacker could exploit this vulnerability by directly accessing the internal services of an affected device. A successful exploit could allow an attacker to impact monitoring of sensors that are managed by the software.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.c
Cisco
Cisco Cyber Vision Center Software Access Control Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3448 Cisco Cyber Vision Center Software Access Control Bypass Vulnerability
CVE-2020-3448: Cisco Cyber Vision Center Software Access Control Bypass Vulnerability
A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication and access internal services that are running on an affected device. The vulnerability is due to insufficient enforcement of access control in the software. An attacker could exploit this vulnerability by directly accessing the internal services of an affected device. A successful exploit could allow an attacker to impact monitoring of sensors that are managed by the software. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-284, CWE-284
Bug IDs: CSCvt81670
GHSA
GHSA-564m-c67j-5hcr: A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authent
ghsa_unreviewed·2022-05-24
CVE-2020-3448 [MEDIUM] GHSA-564m-c67j-5hcr: A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authent
A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication and access internal services that are running on an affected device. The vulnerability is due to insufficient enforcement of access control in the software. An attacker could exploit this vulnerability by directly accessing the internal services of an affected device. A successful exploit could allow an attacker to impact monitoring of sensors that are managed by the software.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-08-17
Published