Cisco IOS XE USB 3.0 SSD access control

Summaryinfo

A vulnerability identified as critical has been detected in Cisco IOS XE. This impacts an unknown function of the component USB 3.0 SSD Handler. This manipulation causes access control. This vulnerability appears as CVE-2020-3396. It is feasible to perform the attack on the physical device. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (affected version not known). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component USB 3.0 SSD Handler. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.

The weakness was presented 09/24/2020 as cisco-sa-iox-usb-guestshell-Wm as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2020-3396 since 12/12/2019. Attacking locally is a requirement. A single authentication is required for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

See VDB-161866, VDB-161865, VDB-161864 and VDB-161862 for similar entries. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion