CVE-2020-3595: cisco cisco sd-wan solution Improper Privilege Management
Vulnerability summary
CVE-2020-3595 is a high (CVSS 7.8) Improper Privilege Management vulnerability in cisco cisco sd-wan solution. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.8% of scored vulnerabilities.
Timeline
- 06-11-2020PublishedVulnerability first disclosed.
- 13-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root group on the underlying operating system. The vulnerability is due to incorrect permissions being set when the affected command is executed. An attacker could exploit this vulnerability by executing the affected command on an affected system. A successful exploit could allow the attacker to gain root privileges.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Cisco2 products
- cisco sd-wan solutionn/a
- sd-wan< 20.1.2 | ≥ 20.3, < 20.3.2
1 vendor · 2 products
References
1 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepegr-4xynYLUjVendor AdvisoryX Refsource CISCOPatch