CVE-2020-3503 Cisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability

Medium 6.0 Published 24 Sep 2020 Updated 13 Nov 2024

An authenticated local attacker can access or modify restricted system files via the guest shell due to insufficient permissions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3503?

CVE-2020-3503 is a medium-severity missing authorization vulnerability in Cisco Ios Xe, published on 24 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.

Weakness: CWE-732, CWE-284

Which versions are affected by CVE-2020-3503?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2020-3503?

No fix has been published for CVE-2020-3503 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-3503 being exploited?

There is no known exploitation of CVE-2020-3503 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-328f-6h62-x2vm.