CVE-2024-20320 — Incorrect Privilege Assignment in Cisco IOS XR Software

CWE-266 — Incorrect Privilege Assignment4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XR SoftwareCisco IOS XR
Timeline
PublishedMar 13

Description

A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of arguments that are included with the SSH client CLI command. An attacker with low-privileged access to an affected device could exploit this vulnerability by issuing a crafted SSH…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xr_software25 versions+24
▶NVDcisco/ios_xr25 versions+24

🔴Vulnerability Details

2
CVEList
CVE-2024-20320: A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series↗2024-03-13
▶
GHSA
GHSA-4hv7-4c5m-8c4c: A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series↗2024-03-13
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XR Software SSH Privilege Escalation Vulnerability↗2024-03-13
▶
CVE-2024-20320 — Incorrect Privilege Assignment | cvebase