Cisco IOS XE ROM Monitor os command injection

Summaryinfo

A vulnerability was found in Cisco IOS XE. It has been classified as critical. This affects an unknown function of the component ROM Monitor. The manipulation leads to os command injection. This vulnerability is listed as CVE-2020-3417. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (unknown version). It has been rated as critical. This issue affects an unknown code block of the component ROM Monitor. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to execute persistent code at boot time and break the chain of trust. This vulnerability is due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit this vulnerability by installing code to a specific directory in the underlying operating system (OS) and setting a specific ROMMON variable. A successful exploit could allow the attacker to execute persistent code on the underlying OS. To exploit this vulnerability, the attacker would need access to the root shell on the device or have physical access to the device.

The weakness was presented 09/24/2020 as cisco-sa-xbace-OnCEbyS as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2020-3417 since 12/12/2019. An attack has to be approached locally. The requirement for exploitation is a simple authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2020). MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading eliminates this vulnerability.

See VDB-161877, VDB-161876, VDB-161875 and VDB-161874 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion