9.8

CVE-2020-9015

EPSS 67.48%
Published 20.02.2020 22:15:12
Last modified 21.11.2024 05:39:49
Source cve@mitre.org
Teams watchlist Login
Open Login

Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands

Affected products Warnungen 0 Metrics 3 CWE 0 References 7

Data is provided by the National Vulnerability Database (NVD)

Arista ≫ Dcs-7050qx-32s-r Firmware Version4.20.9m

Arista ≫ Dcs-7050qx-32s-r Version-

Arista ≫ Dcs-7050cx3-32s-r Firmware Version4.20.11m

Arista ≫ Dcs-7050cx3-32s-r Version-

Arista ≫ Dcs-7280sram-48c6-r Firmware Version4.22.0.1f

Arista ≫ Dcs-7280sram-48c6-r Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	67.48%	0.985

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

http://packetstormsecurity.com/files/158119/Arista-Restricted-Shell-Escape-Privilege-Escalation.html

https://eos.arista.com/arista-eos-is-not-vulnerable-to-cve-2020-9015/

https://securitybytes.me

Third Party Advisory

https://securitybytes.me/posts/cve-2020-9015/

Broken Link

https://nvd.nist.gov/vuln/detail/CVE-2020-9015

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-9015

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-9015

EUVD