CVE-2020-3477: cisco cisco_ios Improper Input Validation

Vulnerability summary

CVE-2020-3477 is a medium (CVSS 5.5) Improper Input Validation vulnerability in cisco cisco_ios. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.9% of scored vulnerabilities.

Timeline

1. 24-09-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain read-only access to files that are located on the flash: filesystem that otherwise might not have been accessible.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.