CVE-2020-3600: cisco cisco sd-wan solution Improper Privilege Management
Vulnerability summary
CVE-2020-3600 is a high (CVSS 7.8) Improper Privilege Management vulnerability in cisco cisco sd-wan solution. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20% of scored vulnerabilities.
Timeline
- 06-11-2020PublishedVulnerability first disclosed.
- 13-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Cisco2 products
- cisco sd-wan solutionn/a
- sd-wan< 20.1.2 | ≥ 20.3, < 20.3.2
1 vendor · 2 products
References
1 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vepeshlg-tJghOQcAVendor AdvisoryX Refsource CISCOPatch