CVE-2020-3216 MEDIUM

CVE-2020-3216: Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability

Vendor Cisco
Product Cisco IOS XE SD-WAN Software
Weakness CWE-287 · Improper authentication
Published June 3, 2020
Last update November 15, 2024

CVSS base score

6.8/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by stopping the boot initialization of an affected device. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device.

Key dates

02Disclosure timeline

June 3, 2020 CVE published
November 15, 2024 Record updated