Cisco IOS XR CLI access control

Summaryinfo

A vulnerability was found in Cisco IOS XR. It has been declared as critical. This affects an unknown function of the component CLI. The manipulation results in access control. This vulnerability is known as CVE-2020-3530. Attacking locally is a requirement. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco IOS XR (Router Operating System) (version now known). Affected is some unknown processing of the component CLI. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that command, even though administrative privileges should be required. The attacker must have valid credentials on the affected device. The vulnerability is due to incorrect mapping in the source code of task group assignments for a specific command. An attacker could exploit this vulnerability by issuing the command, which they should not be authorized to issue, on an affected device. A successful exploit could allow the attacker to invalidate the integrity of the disk and cause the device to restart. This vulnerability could allow a user with read permissions to issue a specific command that should require Administrator privileges.

The weakness was published 09/04/2020 as cisco-sa-iosxr-cli-privescl-sD as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2020-3530 since 12/12/2019. The attack needs to be approached locally. Required for exploitation is a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading eliminates this vulnerability.

Similar entry is available at VDB-160736. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XR

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion