CVE-2020-3364 Security feature bypass in Cisco IOS XR Software
An unauthenticated remote attacker can bypass access control lists on the standby route processor management interface of Cisco IOS XR devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3364?
CVE-2020-3364 is a medium-severity vulnerability in Cisco Ios Xr, published on 18 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XR Software, which prevents the ACL from working when applied against the standby route processor management interface. An attacker could exploit this vulnerability by attempting to access the device through the standby route processor management interface.
Which versions are affected by CVE-2020-3364?
It affects 1 product.
Products include Cisco Ios Xr.
How do I fix CVE-2020-3364?
No fix has been published for CVE-2020-3364 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-3364 being exploited?
There is no known exploitation of CVE-2020-3364 in the wild and no public exploit code.
Other vulnerabilities in Cisco Ios Xr
- CVE-2020-3118 Cisco IOS XR Software Discovery Protocol Format String
- CVE-2020-3569 Cisco IOS XR Software DVMRP Memory Exhaustion
- CVE-2020-3566 Cisco IOS XR Software DVMRP Memory Exhaustion
- CVE-2010-3035 Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service
- CVE-2022-20821 Cisco IOS XR Open Port
Sources
Also known as GHSA-h32p-cwph-5qx4.