CVE-2020-9015 Security feature bypass in n/a
Attackers can bypass TACACS+ shell restrictions on Arista switches by exploiting a permissive regex, potentially gaining unauthorized command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9015?
CVE-2020-9015 is a critical vulnerability in n/a, published on 20 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands
Which versions are affected by CVE-2020-9015?
It affects 3 products.
Products include Arista Dcs-7050cx3-32s-R Firmware, Arista Dcs-7050qx-32s-R Firmware, Arista Dcs-7280sram-48c6-R Firmware.
How do I fix CVE-2020-9015?
No fix has been published for CVE-2020-9015 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9015 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-9015 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-rp5h-fhc8-hqfx.