FKIE_CVE-2020-3396

Vulnerability from fkie_nvd - Published: 2020-09-24 18:15 - Updated: 2024-11-21 05:30
Severity ?
6.8 (Medium) - CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
7.2 (High) - CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.
References
psirt@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDjVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDjVendor Advisory
Impacted products
Vendor Product Version
cisco ios_xe 16.12.1
cisco 1100-4g_integrated_services_router -
cisco 1100-4gltegb_integrated_services_router -
cisco 1100-4gltena_integrated_services_router -
cisco 1100-6g_integrated_services_router -
cisco 1100-lte_integrated_services_router -
cisco 1100_integrated_services_router -
cisco 4321\/k9-rf_integrated_services_router -
cisco 4321\/k9-ws_integrated_services_router -
cisco 4321\/k9_integrated_services_router -
cisco 4331\/k9-rf_integrated_services_router -
cisco 4331\/k9-ws_integrated_services_router -
cisco 4331\/k9_integrated_services_router -
cisco 4351\/k9-rf_integrated_services_router -
cisco 4351\/k9-ws_integrated_services_router -
cisco 4351\/k9_integrated_services_router -
cisco asr_1000-x -
cisco asr_1001 -
cisco asr_1001-x -
cisco asr_1002 -
cisco asr_1002-x -
cisco asr_1004 -
cisco asr_1006 -
cisco asr_1013 -
cisco asr_1023 -
cisco catalyst_c9300-24p -
cisco catalyst_c9300-24s -
cisco catalyst_c9300-24t -
cisco catalyst_c9300-24u -
cisco catalyst_c9300-24ux -
cisco catalyst_c9300-48p -
cisco catalyst_c9300-48s -
cisco catalyst_c9300-48t -
cisco catalyst_c9300-48u -
cisco catalyst_c9300-48un -
cisco catalyst_c9300-48uxm -
cisco catalyst_c9300l-24p-4g -
cisco catalyst_c9300l-24p-4x -
cisco catalyst_c9300l-24t-4g -
cisco catalyst_c9300l-24t-4x -
cisco catalyst_c9300l-48p-4g -
cisco catalyst_c9300l-48p-4x -
cisco catalyst_c9300l-48t-4g -
cisco catalyst_c9300l-48t-4x -
cisco catalyst_c9404r -
cisco catalyst_c9407r -
cisco catalyst_c9410r -
cisco catalyst_c9500-12q -
cisco catalyst_c9500-16x -
cisco catalyst_c9500-24q -
cisco catalyst_c9500-24y4c -
cisco catalyst_c9500-32c -
cisco catalyst_c9500-32qc -
cisco catalyst_c9500-40x -
cisco catalyst_c9500-48y4c -
cisco csr1000v -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C98DED36-D4B5-48D6-964E-EEEE97936700",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F77CD6A-83DA-4F31-A128-AD6DAECD623B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62564BB8-1282-4597-A645-056298BE7CCB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E9CC47-3D7C-437A-85BE-4BB94C8AF1B8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B68B363-3C57-4E95-8B13-0F9B59D551F7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBE4E146-1D77-4F15-AE58-3C1CE5DB62C5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1952B64C-4AE0-4CCB-86C5-8D1FF6A12822",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "05C90C43-2D7D-43F8-AD7F-421878909AE2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "445597DA-7EEC-470D-9A71-BC43A9F7DE5E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "86049773-C88D-4A26-A0D3-D40F3C312AEC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AB4B7C2-4D45-4267-BCBB-57D36C6104A3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B8A4630-8B21-4994-8EF5-E105593A64E5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F799DC02-EB06-458C-8545-A174475FE7A2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B89FBA68-A8ED-4C5A-916E-A68468F59730",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD272E6E-2ED1-4408-8FF7-0B82F9DCBEF8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC278B77-AD63-42AD-B9E8-EE4DE97E27E9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE2182E7-C813-4966-A36C-E648A9344299",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED7C321E-F083-4AB6-96A0-D6358980441E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09C913FF-63D5-43FB-8B39-598EF436BA5A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4376E56-A21C-4642-A85D-439C8E21CD7F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "444F688F-79D0-4F22-B530-7BD520080B8F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "55DD2272-10C2-43B9-9F13-6DC41DBE179B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7428E0A8-1641-47FB-9CA9-34311DEF660D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "854D9594-FE84-4E7B-BA21-A3287F2DC302",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C81CC6E3-B989-4730-820E-46734E3E608D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F257D2BE-7618-4B6A-AFCE-6D9D0084FA1D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BA927CE-9D8E-4BC0-9EA6-641E7C4F71B3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24t:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A46D298-1685-410E-879C-2EBC45C185AC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24u:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA4ACF54-E576-4D8A-A4E6-17A37EEC53DA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24ux:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "196A7C06-8371-479D-973D-591DEB181739",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE42511E-9883-4779-A8E5-FC3E16EF2793",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB06AD21-91A7-46B8-8F44-683828A5422D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48t:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DA169AF-3743-4051-B63B-FF6E1ADCD886",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48u:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D13CF5B-4482-4C7D-8D6A-E220F3E4F868",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48un:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92134C0A-4E5B-43EF-8439-484DF504C43C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48uxm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "26ECF9BD-F632-4A02-8993-C0D44B91289C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24p-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "48730DB5-94AF-4BE7-8047-52B8B47CE35A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24p-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3A88142-3284-4C25-8774-36004B5F9087",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24t-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EB76311-4B6D-4897-A683-4244E92BD570",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24t-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDDA2975-CDB7-4182-A03E-D34F15CDF6F1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48p-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35B9D0B5-4BE1-490E-9A68-00A3D357BC3D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48p-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71FA2F5A-6146-4142-96A8-552118E4BB67",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48t-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEF786D6-F28F-49D8-A15C-BFD0AA934355",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48t-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA32B0AC-1B0A-4ED8-8532-9C7BE6E059D4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9404r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FEFF895-6E4A-4108-BD25-D7DC83154832",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9407r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A485A9A0-2EEC-4C13-846C-0DE2265B2A31",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9410r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B9F1ACA-9D67-4BF0-A357-40D39A61ED00",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-12q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BFEE45F-C5AC-483D-9DE6-4CEB98D80A0C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-16x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD6F5BBC-4627-4A3E-B827-3CEE7EE969D0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-24q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B2E41E2-00CE-42C4-8C91-9307D76F5D7A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-24y4c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "98CB2D23-B5F8-4FA9-8431-3B0124CE2140",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-32c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8A8BA9F-3361-43CD-8031-A5DF0AD68BEB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-32qc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DFE4BB6-FC9A-42B3-B8A0-2610D71BB9B8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-40x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53D13F1D-345D-45D5-9000-DAFE8A85D71B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-48y4c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CFB064E-E390-47B5-AA76-5D3D2E368055",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:csr1000v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62081293-8355-4197-A5A8-1E434B808680",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el sistema de archivos en la USB 3.0 Solid State Drive (SSD) conectable para el Cisco IOS XE Software, podr\u00eda permitir a un atacante f\u00edsico autenticado eliminar el SSD USB 3.0 y modificar \u00e1reas sensibles del sistema de archivos, incluyendo las protecciones del contenedor de espacio de nombres.\u0026#xa0;La vulnerabilidad se produce porque los datos de control del SSD USB 3.0 no se almacenan en la memoria flash de arranque interna.\u0026#xa0;Un atacante podr\u00eda explotar esta vulnerabilidad quitando el SSD USB 3.0, modificando o eliminando archivos en el SSD USB 3.0 usando otro dispositivo y luego reinsertando el SSD USB 3.0 en el dispositivo original.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante eliminar las protecciones del contenedor y realizar acciones de archivos fuera del espacio de nombres del contenedor con privilegios root."
    }
  ],
  "id": "CVE-2020-3396",
  "lastModified": "2024-11-21T05:30:56.857",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.9,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.8,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-24T18:15:17.683",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.