Vulnerability · Published Aug 27, 2020 · Assigned by cisco

CVE-2020-3454Cisco NX-OS Software Call Home Command Injection Vulnerability

High 7.2

In plain English

A high-severity improper input validation in Cisco NX-OS Software 5.0(1a) from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).

Severity (CVSS 3.0)7.2High

Exploit odds (30 days)2.6%top 14.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be executed with root privileges on the underlying operating system (OS). The vulnerability is due to insufficient input validation of specific Call Home configuration parameters when the software is configured for transport method HTTP. An attacker could exploit this vulnerability by modifying parameters within the Call Home configuration on an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying OS.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco NX-OS Software 5.0(1a)	n/a

Weakness: CWE-20 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

20200826 Cisco NX-OS Software Call Home Command Injection Vulnerability vendor-advisory, x_refsource_CISCO