CVE-2020-3169: cisco cisco firepower extensible operating system (fxos) OS Command Injection

Vulnerability summary

CVE-2020-3169 is a high (CVSS 7.2) OS Command Injection vulnerability in cisco cisco firepower extensible operating system (fxos). EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.2% of scored vulnerabilities.

Timeline

1. 26-02-2020
   PublishedVulnerability first disclosed.
2. 15-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. An attacker would need valid administrator credentials to exploit this vulnerability.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.