Vulnerability · Published Sep 24, 2020 · Assigned by cisco

CVE-2020-3503Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability

Medium 6.0

In plain English

A medium-severity improper access control in Cisco IOS XE Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 79.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco IOS XE Software	n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

20200924 Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability vendor-advisory, x_refsource_CISCO