CVE-2020-3503
published 2020-09-24CVE-2020-3503: A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to…
PriorityP429medium6CVSS 3.1
AVLACLPRHUINSUCHIHAN
EPSS
0.28%
19.6th percentile
A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_xe_software | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
CVSS provenance
nvdv3.16.0MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:P/A:N
vendor_cisco6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability
vendor_cisco·2020-09-24·CVSS 6.0
CVE-2020-3503 [MEDIUM] CWE-284 Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability
Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability
A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files.
The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This a
Cisco
Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3503 Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability
CVE-2020-3503: Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability
A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-284, CWE-284
Bug ID
GHSA
GHSA-328f-6h62-x2vm: A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access t
ghsa_unreviewed·2022-05-24
CVE-2020-3503 [MEDIUM] CWE-284 GHSA-328f-6h62-x2vm: A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access t
A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-24
Published