CVE-2020-3602

CWE-20 — Improper Input ValidationCWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUM
EPSS
0.1%
top 68.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco StarosCisco Cisco ASR 5000 Series Software
Timeline
PublishedOct 8
Latest updateMay 24

Description

A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. The vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user on the affected device. To exploit this vulnera…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:HExploitability: 0.8 | Impact: 5.5

Affected Packages2 packages

▶NVDcisco/staros< 21.19.n4

🔴Vulnerability Details

2
GHSA
GHSA-5c39-v7fv-jprr: A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate↗2022-05-24
▶
CVEList
Cisco StarOS Privilege Escalation Vulnerability↗2020-10-08
▶

📋Vendor Advisories

1
Cisco
Cisco StarOS Privilege Escalation Vulnerability↗2020-10-07
▶
CVE-2020-3602 (MEDIUM CVSS 6.7) | A vulnerability in the CLI of Cisco | cvebase.io