CVE-2020-3227 Cisco IOx for IOS XE Software Privilege Escalation Vulnerability

Critical 9.8 Published 3 Jun 2020 Updated 15 Nov 2024

Unauthenticated attackers can bypass authorization to execute arbitrary IOx API commands on Cisco IOS XE devices, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3227?

CVE-2020-3227 is a critical missing authorization vulnerability in Cisco Ios Xe, published on 3 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is due to incorrect handling of requests for authorization tokens. An attacker could exploit this vulnerability by using a crafted API call to request such a token. An exploit could allow the attacker to obtain an authorization token and execute any of the IOx API commands on an affected device.

Weakness: CWE-863, CWE-264

Which versions are affected by CVE-2020-3227?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2020-3227?

No fix has been published for CVE-2020-3227 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-3227 being exploited?

There is no known exploitation of CVE-2020-3227 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-qmfx-jqw3-rhhv.