CVE-2020-3396 Cisco IOS XE Software IOx Guest Shell USB SSD Namespace Protection Privilege Escalation Vulnerability

Medium 6.8 Published 24 Sep 2020 Updated 13 Nov 2024

Physical attackers can modify USB SSD files to bypass container protections and gain root privileges on Cisco IOS XE devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3396?

CVE-2020-3396 is a medium-severity vulnerability in Cisco Ios Xe, published on 24 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.

Weakness: CWE-269, CWE-284

Which versions are affected by CVE-2020-3396?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2020-3396?

No fix has been published for CVE-2020-3396 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3396 being exploited?

There is no known exploitation of CVE-2020-3396 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-22hc-p772-wg38.