CVE-2020-3166

EPSS 0.17%
Published 26.02.2020 17:15:12
Last modified 21.11.2024 05:30:27
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system (OS). The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted arguments to a specific CLI command. A successful exploit could allow the attacker to read or write to arbitrary files on the underlying OS.

Affected products Warnungen 0 Metrics 4 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Firepower Threat Defense Version >= 6.2.2 < 6.2.3.16

   Cisco ≫ Firepower 1010 Version-
   Cisco ≫ Firepower 1120 Version-
   Cisco ≫ Firepower 1140 Version-
   Cisco ≫ Firepower 1150 Version-
   Cisco ≫ Firepower 2110 Version-
   Cisco ≫ Firepower 2120 Version-
   Cisco ≫ Firepower 2130 Version-
   Cisco ≫ Firepower 2140 Version-

Cisco ≫ Firepower Threat Defense Version >= 6.3.0 < 6.5.0.3

Cisco ≫ Adaptive Security Appliance Software Version >= 9.8 < 9.9.2.66

Cisco ≫ Adaptive Security Appliance Software Version >= 9.10 < 9.13.1.5

Cisco ≫ Firepower Extensible Operating System Version < 2.2.2.97

   Cisco ≫ Firepower 4110 Version-
   Cisco ≫ Firepower 4115 Version-
   Cisco ≫ Firepower 4120 Version-
   Cisco ≫ Firepower 4125 Version-
   Cisco ≫ Firepower 4140 Version-
   Cisco ≫ Firepower 4145 Version-
   Cisco ≫ Firepower 4150 Version-
   Cisco ≫ Firepower 9300 Version-

Cisco ≫ Firepower Extensible Operating System Version >= 2.3 < 2.3.1.155

Cisco ≫ Firepower Extensible Operating System Version >= 2.4 < 2.4.1.238

Cisco ≫ Firepower Extensible Operating System Version >= 2.6 < 2.6.1.157

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.17%	0.388

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.7	0.8	5.9	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P
psirt@cisco.com	4.2	0.8	3.4	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-cli-file

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-3166

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-3166

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-3166

EUVD