CVE-2020-3476 MEDIUM

CVE-2020-3476: Cisco IOS XE Software Arbitrary File Overwrite Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-552 · Files accessible externally
Published September 24, 2020
Last update November 13, 2024

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A vulnerability in the CLI implementation of a specific command of Cisco IOS XE Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying host file system. The vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of any arbitrary file that resides on the underlying host file system.

Key dates

02Disclosure timeline

September 24, 2020 CVE published
November 13, 2024 Record updated