CVE-2020-3503 MEDIUM

CVE-2020-3503: Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-284
Published September 24, 2020
Last update November 13, 2024

CVSS base score

6.0/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.

Key dates

02Disclosure timeline

September 24, 2020 CVE published
November 13, 2024 Record updated