Vulnerability · Published Jun 8, 2020 · Assigned by redhat

CVE-2020-10754

Medium 4.3

In plain English

A medium-severity improper authentication in NetworkManager from [Red Hat]. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.0%top 37.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	network-manager	1.24.2-1	DEBIAN-CVE-2020-10754
Debian:13	network-manager	1.24.2-1	DEBIAN-CVE-2020-10754
Debian:14	network-manager	1.24.2-1	DEBIAN-CVE-2020-10754

Affected products (as reported)

Vendor	Product	Versions
[Red Hat]	NetworkManager	1.24.2

Weakness: CWE-287, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10754 x_refsource_CONFIRM
FEDORA-2020-ace543feff vendor-advisory, x_refsource_FEDORA