CVE-2020-3545: cisco cisco firepower extensible operating system (fxos)

Vulnerability summary

CVE-2020-3545 is a high (CVSS 7.2) vulnerability in cisco cisco firepower extensible operating system (fxos). EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.1% of scored vulnerabilities.

Timeline

1. 04-09-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that, when it is processed, may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.