9.8
CVE-2020-8349
- EPSS 2.62%
- Published 14.10.2020 22:15:13
- Last modified 21.11.2024 05:38:45
- Source psirt@lenovo.com
- Teams watchlist Login
- Open Login
An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST API management interface. This interface is disabled by default and not vulnerable unless enabled. When enabled, it is only vulnerable where attached to a VRF and as allowed by defined ACLs. Lenovo strongly recommends upgrading to a non-vulnerable CNOS release. Where not possible, Lenovo recommends disabling the REST API management interface or restricting access to the management VRF and further limiting access to authorized management stations via ACL.
Data is provided by the National Vulnerability Database (NVD)
Lenovo ≫ Cloud Networking Operating System Version < 10.10.6.0
Lenovo ≫ Rackswitch G8272 Version-
Lenovo ≫ Rackswitch G8296 Version-
Lenovo ≫ Rackswitch G8332 Version-
Lenovo ≫ Rackswitch Ne0152t Version-
Lenovo ≫ Rackswitch Ne10032 Version-
Lenovo ≫ Rackswitch Ne1032 Version-
Lenovo ≫ Rackswitch Ne1032t Version-
Lenovo ≫ Rackswitch Ne1072t Version-
Lenovo ≫ Rackswitch Ne2572 Version-
Lenovo ≫ Rackswitch G8296 Version-
Lenovo ≫ Rackswitch G8332 Version-
Lenovo ≫ Rackswitch Ne0152t Version-
Lenovo ≫ Rackswitch Ne10032 Version-
Lenovo ≫ Rackswitch Ne1032 Version-
Lenovo ≫ Rackswitch Ne1032t Version-
Lenovo ≫ Rackswitch Ne1072t Version-
Lenovo ≫ Rackswitch Ne2572 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.62% | 0.843 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
| psirt@lenovo.com | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.