Cisco IOS Software for Cisco Industrial Routers Virtual Device Server CLI Command Injection Vulnerability
A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated, local attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The attacker must have valid user credentials at privilege level 15. The vulnerability is due to insufficient validation of arguments that are passed to specific VDS-related CLI commands. An attacker could exploit this vulnerability by authenticating to the targeted device and including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE"] This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [" https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-73388"].
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-3210US | medium6.7 | — | ||
A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- cisco-sa-ios-iot-udp-vds-inj-f2D5Jzrtexternal
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhEexternal
- cisco-sa-ios-iot-vds-cred-uPMp9zbYexternal
- cisco-sa-ios-ir800-img-verif-wHhLYHjKexternal
- Security Vulnerability Policyexternal
- considering software upgradesexternal
- Cisco Software Checkerexternal
- Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publicationexternal
Behebungen (29)
- Behoben12.2(60)EZ16
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.0(2)SG11a
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVR1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVR10
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVR2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVR3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVS
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVS1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVT1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVT2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVT3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVT4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVU1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVU10
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVU11
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVU2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVU20
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVU21
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVV1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVV2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVV3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVV4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVW
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVW1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVX
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.1(3)SVX1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.3(3)JAA1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.9(3)M
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben15.9(3)M0a
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan