Cisco IOS XE Aggregation Services routine

Summaryinfo

A vulnerability was found in Cisco IOS XE. It has been rated as critical. Impacted is an unknown function of the component Aggregation Services. The manipulation leads to routine. This vulnerability is listed as CVE-2020-3513. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco IOS XE (Router Operating System) (version unknown). This issue affects an unknown function of the component Aggregation Services. The manipulation with an unknown input leads to a routine vulnerability. Using CWE to declare the problem leads to CWE-749. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed could allow an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. These vulnerabilities are due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit these vulnerabilities by copying a specific file to the local file system of an affected device and defining specific ROMMON variables. A successful exploit could allow the attacker to run arbitrary code on the underlying operating system (OS) with root privileges. To exploit these vulnerabilities, an attacker would need to have access to the root shell on the device or have physical access to the device.

The weakness was presented 09/24/2020 as cisco-sa-iosxe-rsp3-rce-jVHg8Z as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. The identification of this vulnerability is CVE-2020-3513 since 12/12/2019. Attacking locally is a requirement. The successful exploitation requires a simple authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2020).

Upgrading eliminates this vulnerability.

See VDB-161872 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion