Vulnerability-Lookup

BDU:2020-05710

Vulnerability from fstec - Published: 24.09.2020

Title

Уязвимость командного синтаксического анализатора CLI операционных системы Cisco IOS и Cisco IOS XE, позволяющая нарушителю получить доступ к защищаемой информации

Description

Уязвимость командного синтаксического анализатора CLI операционных системы Cisco IOS и Cisco IOS XE связана с ошибками при обработке входных данных. Эксплуатация уязвимости может позволить нарушителю получить доступ к защищаемой информации

Severity ?


                    
                      AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vendor

Cisco Systems Inc.

Software Name

Cisco IOS, Cisco IOS XE

Software Version

12.4 (Cisco IOS), 15.3s (Cisco IOS), 16.1 (Cisco IOS XE), 16.2 (Cisco IOS XE), 3.9S (Cisco IOS XE), 3.2SE (Cisco IOS XE), 3.3XO (Cisco IOS XE), 16.3 (Cisco IOS XE), 3.7E (Cisco IOS XE), 3.8E (Cisco IOS XE), 3.9E (Cisco IOS XE), 3.10S (Cisco IOS XE), 3.15S (Cisco IOS XE), 3.16S (Cisco IOS XE), 3.17S (Cisco IOS XE), 3.2SG (Cisco IOS XE), 3.7S (Cisco IOS XE), 3.3SG (Cisco IOS XE), 3.8S (Cisco IOS XE), 3.3SE (Cisco IOS XE), 3.4SG (Cisco IOS XE), 3.5E (Cisco IOS XE), 3.11S (Cisco IOS XE), 3.12S (Cisco IOS XE), 3.13S (Cisco IOS XE), 3.6E (Cisco IOS XE), 3.14S (Cisco IOS XE), 3.3SQ (Cisco IOS XE), 3.4SQ (Cisco IOS XE), 3.5SQ (Cisco IOS XE), 3.18S (Cisco IOS XE), 3.18SP (Cisco IOS XE), 3.10E (Cisco IOS XE), 12.2ZI (Cisco IOS), 12.2EZ (Cisco IOS), 12.2SB (Cisco IOS), 12.4MD (Cisco IOS), 12.2SRC (Cisco IOS), 12.2SRD (Cisco IOS), 12.2SXI (Cisco IOS), 12.4JY (Cisco IOS), 12.2SRE (Cisco IOS), 15.0S (Cisco IOS), 15.2S (Cisco IOS), 15.0EY (Cisco IOS), 12.2ZZ (Cisco IOS), 15.1S (Cisco IOS), 15.0SY (Cisco IOS), 12.2SXJ (Cisco IOS), 12.2SCF (Cisco IOS), 12.2SCE (Cisco IOS), 15.0SG (Cisco IOS), 15.0EX (Cisco IOS), 12.2SCG (Cisco IOS), 15.1SY (Cisco IOS), 12.2SCH (Cisco IOS), 15.4S (Cisco IOS), 15.2SC (Cisco IOS), 15.2SY (Cisco IOS), 15.5S (Cisco IOS), 12.2SCI (Cisco IOS), 15.3SY (Cisco IOS), 12.2SCJ (Cisco IOS), 15.6SP (Cisco IOS), 15.4SY (Cisco IOS), 15.5SY (Cisco IOS), 15.0XA (Cisco IOS), 15.1T (Cisco IOS), 15.1XB (Cisco IOS), 15.1M (Cisco IOS), 15.1GC (Cisco IOS), 15.0MR (Cisco IOS), 15.1MRA (Cisco IOS), 15.1SVB (Cisco IOS), 15.1SVD (Cisco IOS), 15.1SVF (Cisco IOS), 15.1SVE (Cisco IOS), 15.2SD (Cisco IOS), 15.1SVG (Cisco IOS), 15.4SN (Cisco IOS), 15.1SVH (Cisco IOS), 15.5SN (Cisco IOS), 15.6S (Cisco IOS), 15.1SVI (Cisco IOS), 15.6SN (Cisco IOS), 15.1SVJ (Cisco IOS), 15.3JF (Cisco IOS), 15.1SG (Cisco IOS), 15.2E (Cisco IOS), 16.12 (Cisco IOS XE), 12.2SE (Cisco IOS), 12.2EX (Cisco IOS), 12.2EY (Cisco IOS), 12.4MR (Cisco IOS), 12.4T (Cisco IOS), 12.2SG (Cisco IOS), 12.4XZ (Cisco IOS), 12.4XR (Cisco IOS), 12.2XO (Cisco IOS), 12.4MDA (Cisco IOS), 12.4YG (Cisco IOS), 15.0M (Cisco IOS), 15.0XO (Cisco IOS), 12.4MRB (Cisco IOS), 12.2WO (Cisco IOS), 15.0SE (Cisco IOS), 12.4MDB (Cisco IOS), 15.0EZ (Cisco IOS), 12.4YS (Cisco IOS), 15.2EY (Cisco IOS), 15.0EJ (Cisco IOS), 15.2EX (Cisco IOS), 15.0EK (Cisco IOS), 15.2EB (Cisco IOS), 15.2EA (Cisco IOS), 15.0SQD (Cisco IOS), 15.2EC (Cisco IOS), 12.2I (Cisco IOS), 15.1SVS (Cisco IOS), 3.11E (Cisco IOS XE), 15.3JK (Cisco IOS), 15.1SVR (Cisco IOS), 12.2CX (Cisco IOS), 12.2CY (Cisco IOS), 12.4JA (Cisco IOS), 12.4XQ (Cisco IOS), 12.4JX (Cisco IOS), 12.2MRA (Cisco IOS), 12.2MRB (Cisco IOS), 12.4JHA (Cisco IOS), 12.4M (Cisco IOS), 12.4JHC (Cisco IOS), 12.4JAX (Cisco IOS), 12.4JAZ (Cisco IOS), 12.4JB (Cisco IOS), 12.4JAL (Cisco IOS), 12.4JAM (Cisco IOS), 12.4JAO (Cisco IOS), 12.4JAP (Cisco IOS)

Possible Mitigations

Использование рекомендаций: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF

Reference

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF https://nvd.nist.gov/vuln/detail/CVE-2020-3477

CWE

CWE-20

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "12.4 (Cisco IOS), 15.3s (Cisco IOS), 16.1 (Cisco IOS XE), 16.2 (Cisco IOS XE), 3.9S (Cisco IOS XE), 3.2SE (Cisco IOS XE), 3.3XO (Cisco IOS XE), 16.3 (Cisco IOS XE), 3.7E (Cisco IOS XE), 3.8E (Cisco IOS XE), 3.9E (Cisco IOS XE), 3.10S (Cisco IOS XE), 3.15S (Cisco IOS XE), 3.16S (Cisco IOS XE), 3.17S (Cisco IOS XE), 3.2SG (Cisco IOS XE), 3.7S (Cisco IOS XE), 3.3SG (Cisco IOS XE), 3.8S (Cisco IOS XE), 3.3SE (Cisco IOS XE), 3.4SG (Cisco IOS XE), 3.5E (Cisco IOS XE), 3.11S (Cisco IOS XE), 3.12S (Cisco IOS XE), 3.13S (Cisco IOS XE), 3.6E (Cisco IOS XE), 3.14S (Cisco IOS XE), 3.3SQ (Cisco IOS XE), 3.4SQ (Cisco IOS XE), 3.5SQ (Cisco IOS XE), 3.18S (Cisco IOS XE), 3.18SP (Cisco IOS XE), 3.10E (Cisco IOS XE), 12.2ZI (Cisco IOS), 12.2EZ (Cisco IOS), 12.2SB (Cisco IOS), 12.4MD (Cisco IOS), 12.2SRC (Cisco IOS), 12.2SRD (Cisco IOS), 12.2SXI (Cisco IOS), 12.4JY (Cisco IOS), 12.2SRE (Cisco IOS), 15.0S (Cisco IOS), 15.2S (Cisco IOS), 15.0EY (Cisco IOS), 12.2ZZ (Cisco IOS), 15.1S (Cisco IOS), 15.0SY (Cisco IOS), 12.2SXJ (Cisco IOS), 12.2SCF (Cisco IOS), 12.2SCE (Cisco IOS), 15.0SG (Cisco IOS), 15.0EX (Cisco IOS), 12.2SCG (Cisco IOS), 15.1SY (Cisco IOS), 12.2SCH (Cisco IOS), 15.4S (Cisco IOS), 15.2SC (Cisco IOS), 15.2SY (Cisco IOS), 15.5S (Cisco IOS), 12.2SCI (Cisco IOS), 15.3SY (Cisco IOS), 12.2SCJ (Cisco IOS), 15.6SP (Cisco IOS), 15.4SY (Cisco IOS), 15.5SY (Cisco IOS), 15.0XA (Cisco IOS), 15.1T (Cisco IOS), 15.1XB (Cisco IOS), 15.1M (Cisco IOS), 15.1GC (Cisco IOS), 15.0MR (Cisco IOS), 15.1MRA (Cisco IOS), 15.1SVB (Cisco IOS), 15.1SVD (Cisco IOS), 15.1SVF (Cisco IOS), 15.1SVE (Cisco IOS), 15.2SD (Cisco IOS), 15.1SVG (Cisco IOS), 15.4SN (Cisco IOS), 15.1SVH (Cisco IOS), 15.5SN (Cisco IOS), 15.6S (Cisco IOS), 15.1SVI (Cisco IOS), 15.6SN (Cisco IOS), 15.1SVJ (Cisco IOS), 15.3JF (Cisco IOS), 15.1SG (Cisco IOS), 15.2E (Cisco IOS), 16.12 (Cisco IOS XE), 12.2SE (Cisco IOS), 12.2EX (Cisco IOS), 12.2EY (Cisco IOS), 12.4MR (Cisco IOS), 12.4T (Cisco IOS), 12.2SG (Cisco IOS), 12.4XZ (Cisco IOS), 12.4XR (Cisco IOS), 12.2XO (Cisco IOS), 12.4MDA (Cisco IOS), 12.4YG (Cisco IOS), 15.0M (Cisco IOS), 15.0XO (Cisco IOS), 12.4MRB (Cisco IOS), 12.2WO (Cisco IOS), 15.0SE (Cisco IOS), 12.4MDB (Cisco IOS), 15.0EZ (Cisco IOS), 12.4YS (Cisco IOS), 15.2EY (Cisco IOS), 15.0EJ (Cisco IOS), 15.2EX (Cisco IOS), 15.0EK (Cisco IOS), 15.2EB (Cisco IOS), 15.2EA (Cisco IOS), 15.0SQD (Cisco IOS), 15.2EC (Cisco IOS), 12.2I (Cisco IOS), 15.1SVS (Cisco IOS), 3.11E (Cisco IOS XE), 15.3JK (Cisco IOS), 15.1SVR (Cisco IOS), 12.2CX (Cisco IOS), 12.2CY (Cisco IOS), 12.4JA (Cisco IOS), 12.4XQ (Cisco IOS), 12.4JX (Cisco IOS), 12.2MRA (Cisco IOS), 12.2MRB (Cisco IOS), 12.4JHA (Cisco IOS), 12.4M (Cisco IOS), 12.4JHC (Cisco IOS), 12.4JAX (Cisco IOS), 12.4JAZ (Cisco IOS), 12.4JB (Cisco IOS), 12.4JAL (Cisco IOS), 12.4JAM (Cisco IOS), 12.4JAO (Cisco IOS), 12.4JAP (Cisco IOS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "24.09.2020",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "18.12.2020",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "18.12.2020",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2020-05710",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2020-3477",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Cisco IOS, Cisco IOS XE",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Cisco Systems Inc. Cisco IOS 12.4 , Cisco Systems Inc. Cisco IOS 15.3s , Cisco Systems Inc. Cisco IOS XE 16.1 , Cisco Systems Inc. Cisco IOS XE 16.2 , Cisco Systems Inc. Cisco IOS XE 3.9S , Cisco Systems Inc. Cisco IOS XE 3.2SE , Cisco Systems Inc. Cisco IOS XE 3.3XO , Cisco Systems Inc. Cisco IOS XE 16.3 , Cisco Systems Inc. Cisco IOS XE 3.7E , Cisco Systems Inc. Cisco IOS XE 3.8E , Cisco Systems Inc. Cisco IOS XE 3.9E , Cisco Systems Inc. Cisco IOS XE 3.10S , Cisco Systems Inc. Cisco IOS XE 3.15S , Cisco Systems Inc. Cisco IOS XE 3.16S , Cisco Systems Inc. Cisco IOS XE 3.17S , Cisco Systems Inc. Cisco IOS XE 3.2SG , Cisco Systems Inc. Cisco IOS XE 3.7S , Cisco Systems Inc. Cisco IOS XE 3.3SG , Cisco Systems Inc. Cisco IOS XE 3.8S , Cisco Systems Inc. Cisco IOS XE 3.3SE , Cisco Systems Inc. Cisco IOS XE 3.4SG , Cisco Systems Inc. Cisco IOS XE 3.5E , Cisco Systems Inc. Cisco IOS XE 3.11S , Cisco Systems Inc. Cisco IOS XE 3.12S , Cisco Systems Inc. Cisco IOS XE 3.13S , Cisco Systems Inc. Cisco IOS XE 3.6E , Cisco Systems Inc. Cisco IOS XE 3.14S , Cisco Systems Inc. Cisco IOS XE 3.3SQ , Cisco Systems Inc. Cisco IOS XE 3.4SQ , Cisco Systems Inc. Cisco IOS XE 3.5SQ , Cisco Systems Inc. Cisco IOS XE 3.18S , Cisco Systems Inc. Cisco IOS XE 3.18SP , Cisco Systems Inc. Cisco IOS XE 3.10E , Cisco Systems Inc. Cisco IOS 12.2ZI , Cisco Systems Inc. Cisco IOS 12.2EZ , Cisco Systems Inc. Cisco IOS 12.2SB , Cisco Systems Inc. Cisco IOS 12.4MD , Cisco Systems Inc. Cisco IOS 12.2SRC , Cisco Systems Inc. Cisco IOS 12.2SRD , Cisco Systems Inc. Cisco IOS 12.2SXI , Cisco Systems Inc. Cisco IOS 12.4JY , Cisco Systems Inc. Cisco IOS 12.2SRE , Cisco Systems Inc. Cisco IOS 15.0S , Cisco Systems Inc. Cisco IOS 15.2S , Cisco Systems Inc. Cisco IOS 15.0EY , Cisco Systems Inc. Cisco IOS 12.2ZZ , Cisco Systems Inc. Cisco IOS 15.1S , Cisco Systems Inc. Cisco IOS 15.0SY , Cisco Systems Inc. Cisco IOS 12.2SXJ , Cisco Systems Inc. Cisco IOS 12.2SCF , Cisco Systems Inc. Cisco IOS 12.2SCE , Cisco Systems Inc. Cisco IOS 15.0SG , Cisco Systems Inc. Cisco IOS 15.0EX , Cisco Systems Inc. Cisco IOS 12.2SCG , Cisco Systems Inc. Cisco IOS 15.1SY , Cisco Systems Inc. Cisco IOS 12.2SCH , Cisco Systems Inc. Cisco IOS 15.4S , Cisco Systems Inc. Cisco IOS 15.2SC , Cisco Systems Inc. Cisco IOS 15.2SY , Cisco Systems Inc. Cisco IOS 15.5S , Cisco Systems Inc. Cisco IOS 12.2SCI , Cisco Systems Inc. Cisco IOS 15.3SY , Cisco Systems Inc. Cisco IOS 12.2SCJ , Cisco Systems Inc. Cisco IOS 15.6SP , Cisco Systems Inc. Cisco IOS 15.4SY , Cisco Systems Inc. Cisco IOS 15.5SY , Cisco Systems Inc. Cisco IOS 15.0XA , Cisco Systems Inc. Cisco IOS 15.1T , Cisco Systems Inc. Cisco IOS 15.1XB , Cisco Systems Inc. Cisco IOS 15.1M , Cisco Systems Inc. Cisco IOS 15.1GC , Cisco Systems Inc. Cisco IOS 15.0MR , Cisco Systems Inc. Cisco IOS 15.1MRA , Cisco Systems Inc. Cisco IOS 15.1SVB , Cisco Systems Inc. Cisco IOS 15.1SVD , Cisco Systems Inc. Cisco IOS 15.1SVF , Cisco Systems Inc. Cisco IOS 15.1SVE , Cisco Systems Inc. Cisco IOS 15.2SD , Cisco Systems Inc. Cisco IOS 15.1SVG , Cisco Systems Inc. Cisco IOS 15.4SN , Cisco Systems Inc. Cisco IOS 15.1SVH , Cisco Systems Inc. Cisco IOS 15.5SN , Cisco Systems Inc. Cisco IOS 15.6S , Cisco Systems Inc. Cisco IOS 15.1SVI , Cisco Systems Inc. Cisco IOS 15.6SN , Cisco Systems Inc. Cisco IOS 15.1SVJ , Cisco Systems Inc. Cisco IOS 15.3JF , Cisco Systems Inc. Cisco IOS 15.1SG , Cisco Systems Inc. Cisco IOS 15.2E , Cisco Systems Inc. Cisco IOS XE 16.12 , Cisco Systems Inc. Cisco IOS 12.2SE , Cisco Systems Inc. Cisco IOS 12.2EX , Cisco Systems Inc. Cisco IOS 12.2EY , Cisco Systems Inc. Cisco IOS 12.4MR , Cisco Systems Inc. Cisco IOS 12.4T , Cisco Systems Inc. Cisco IOS 12.2SG , Cisco Systems Inc. Cisco IOS 12.4XZ , Cisco Systems Inc. Cisco IOS 12.4XR , Cisco Systems Inc. Cisco IOS 12.2XO , Cisco Systems Inc. Cisco IOS 12.4MDA , Cisco Systems Inc. Cisco IOS 12.4YG , Cisco Systems Inc. Cisco IOS 15.0M , Cisco Systems Inc. Cisco IOS 15.0XO , Cisco Systems Inc. Cisco IOS 12.4MRB , Cisco Systems Inc. Cisco IOS 12.2WO , Cisco Systems Inc. Cisco IOS 15.0SE , Cisco Systems Inc. Cisco IOS 12.4MDB , Cisco Systems Inc. Cisco IOS 15.0EZ , Cisco Systems Inc. Cisco IOS 12.4YS , Cisco Systems Inc. Cisco IOS 15.2EY , Cisco Systems Inc. Cisco IOS 15.0EJ , Cisco Systems Inc. Cisco IOS 15.2EX , Cisco Systems Inc. Cisco IOS 15.0EK , Cisco Systems Inc. Cisco IOS 15.2EB , Cisco Systems Inc. Cisco IOS 15.2EA , Cisco Systems Inc. Cisco IOS 15.0SQD , Cisco Systems Inc. Cisco IOS 15.2EC , Cisco Systems Inc. Cisco IOS 12.2I , Cisco Systems Inc. Cisco IOS 15.1SVS , Cisco Systems Inc. Cisco IOS XE 3.11E , Cisco Systems Inc. Cisco IOS 15.3JK , Cisco Systems Inc. Cisco IOS 15.1SVR , Cisco Systems Inc. Cisco IOS 12.2CX , Cisco Systems Inc. Cisco IOS 12.2CY , Cisco Systems Inc. Cisco IOS 12.4JA , Cisco Systems Inc. Cisco IOS 12.4XQ , Cisco Systems Inc. Cisco IOS 12.4JX , Cisco Systems Inc. Cisco IOS 12.2MRA , Cisco Systems Inc. Cisco IOS 12.2MRB , Cisco Systems Inc. Cisco IOS 12.4JHA , Cisco Systems Inc. Cisco IOS 12.4M , Cisco Systems Inc. Cisco IOS 12.4JHC , Cisco Systems Inc. Cisco IOS 12.4JAX , Cisco Systems Inc. Cisco IOS 12.4JAZ , Cisco Systems Inc. Cisco IOS 12.4JB , Cisco Systems Inc. Cisco IOS 12.4JAL , Cisco Systems Inc. Cisco IOS 12.4JAM , Cisco Systems Inc. Cisco IOS 12.4JAO , Cisco Systems Inc. Cisco IOS 12.4JAP ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0430 CLI \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Cisco IOS \u0438 Cisco IOS XE, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0430 CLI \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Cisco IOS \u0438 Cisco IOS XE \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-3477",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

CVE-2020-3477 (GCVE-0-2020-3477)

Vulnerability from cvelistv5 – Published: 2020-09-24 17:52 – Updated: 2024-11-13 17:58

Title

Cisco IOS and IOS XE Software Information Disclosure Vulnerability

Summary

A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain read-only access to files that are located on the flash: filesystem that otherwise might not have been accessible.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-20

Assigner

cisco

References

URL

Tags

https://tools.cisco.com/security/center/content/C…

vendor-advisoryx_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco IOS	Affected: n/a

Date Public ?

2020-09-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:37:54.308Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20200924 Cisco IOS and IOS XE Software Information Disclosure Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-3477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T17:23:19.644914Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T17:58:01.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco IOS",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-09-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain read-only access to files that are located on the flash: filesystem that otherwise might not have been accessible."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-24T17:52:48.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20200924 Cisco IOS and IOS XE Software Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF"
        }
      ],
      "source": {
        "advisory": "cisco-sa-info-disclosure-V4BmJBNF",
        "defect": [
          [
            "CSCvu10399"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco IOS and IOS XE Software Information Disclosure Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2020-09-24T16:00:00",
          "ID": "CVE-2020-3477",
          "STATE": "PUBLIC",
          "TITLE": "Cisco IOS and IOS XE Software Information Disclosure Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco IOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain read-only access to files that are located on the flash: filesystem that otherwise might not have been accessible."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "5.5",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20200924 Cisco IOS and IOS XE Software Information Disclosure Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-info-disclosure-V4BmJBNF",
          "defect": [
            [
              "CSCvu10399"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2020-3477",
    "datePublished": "2020-09-24T17:52:48.475Z",
    "dateReserved": "2019-12-12T00:00:00.000Z",
    "dateUpdated": "2024-11-13T17:58:01.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2020-05710

CVE-2020-3477 (GCVE-0-2020-3477)

Tags

Sightings

Nomenclature