fkie_cve-2020-3396
Vulnerability from fkie_nvd
Published
2020-09-24 18:15
Modified
2024-11-21 05:30
Severity ?
6.8 (Medium) - CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
7.2 (High) - CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.
References
psirt@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDjVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDjVendor Advisory
Impacted products
Vendor Product Version
cisco ios_xe 16.12.1
cisco 1100-4g_integrated_services_router -
cisco 1100-4gltegb_integrated_services_router -
cisco 1100-4gltena_integrated_services_router -
cisco 1100-6g_integrated_services_router -
cisco 1100-lte_integrated_services_router -
cisco 1100_integrated_services_router -
cisco 4321\/k9-rf_integrated_services_router -
cisco 4321\/k9-ws_integrated_services_router -
cisco 4321\/k9_integrated_services_router -
cisco 4331\/k9-rf_integrated_services_router -
cisco 4331\/k9-ws_integrated_services_router -
cisco 4331\/k9_integrated_services_router -
cisco 4351\/k9-rf_integrated_services_router -
cisco 4351\/k9-ws_integrated_services_router -
cisco 4351\/k9_integrated_services_router -
cisco asr_1000-x -
cisco asr_1001 -
cisco asr_1001-x -
cisco asr_1002 -
cisco asr_1002-x -
cisco asr_1004 -
cisco asr_1006 -
cisco asr_1013 -
cisco asr_1023 -
cisco catalyst_c9300-24p -
cisco catalyst_c9300-24s -
cisco catalyst_c9300-24t -
cisco catalyst_c9300-24u -
cisco catalyst_c9300-24ux -
cisco catalyst_c9300-48p -
cisco catalyst_c9300-48s -
cisco catalyst_c9300-48t -
cisco catalyst_c9300-48u -
cisco catalyst_c9300-48un -
cisco catalyst_c9300-48uxm -
cisco catalyst_c9300l-24p-4g -
cisco catalyst_c9300l-24p-4x -
cisco catalyst_c9300l-24t-4g -
cisco catalyst_c9300l-24t-4x -
cisco catalyst_c9300l-48p-4g -
cisco catalyst_c9300l-48p-4x -
cisco catalyst_c9300l-48t-4g -
cisco catalyst_c9300l-48t-4x -
cisco catalyst_c9404r -
cisco catalyst_c9407r -
cisco catalyst_c9410r -
cisco catalyst_c9500-12q -
cisco catalyst_c9500-16x -
cisco catalyst_c9500-24q -
cisco catalyst_c9500-24y4c -
cisco catalyst_c9500-32c -
cisco catalyst_c9500-32qc -
cisco catalyst_c9500-40x -
cisco catalyst_c9500-48y4c -
cisco csr1000v -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C98DED36-D4B5-48D6-964E-EEEE97936700",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F77CD6A-83DA-4F31-A128-AD6DAECD623B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62564BB8-1282-4597-A645-056298BE7CCB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E9CC47-3D7C-437A-85BE-4BB94C8AF1B8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B68B363-3C57-4E95-8B13-0F9B59D551F7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBE4E146-1D77-4F15-AE58-3C1CE5DB62C5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1952B64C-4AE0-4CCB-86C5-8D1FF6A12822",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "05C90C43-2D7D-43F8-AD7F-421878909AE2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "445597DA-7EEC-470D-9A71-BC43A9F7DE5E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "86049773-C88D-4A26-A0D3-D40F3C312AEC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AB4B7C2-4D45-4267-BCBB-57D36C6104A3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B8A4630-8B21-4994-8EF5-E105593A64E5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F799DC02-EB06-458C-8545-A174475FE7A2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B89FBA68-A8ED-4C5A-916E-A68468F59730",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD272E6E-2ED1-4408-8FF7-0B82F9DCBEF8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC278B77-AD63-42AD-B9E8-EE4DE97E27E9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE2182E7-C813-4966-A36C-E648A9344299",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED7C321E-F083-4AB6-96A0-D6358980441E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09C913FF-63D5-43FB-8B39-598EF436BA5A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4376E56-A21C-4642-A85D-439C8E21CD7F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "444F688F-79D0-4F22-B530-7BD520080B8F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "55DD2272-10C2-43B9-9F13-6DC41DBE179B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7428E0A8-1641-47FB-9CA9-34311DEF660D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "854D9594-FE84-4E7B-BA21-A3287F2DC302",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C81CC6E3-B989-4730-820E-46734E3E608D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F257D2BE-7618-4B6A-AFCE-6D9D0084FA1D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BA927CE-9D8E-4BC0-9EA6-641E7C4F71B3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24t:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A46D298-1685-410E-879C-2EBC45C185AC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24u:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA4ACF54-E576-4D8A-A4E6-17A37EEC53DA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-24ux:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "196A7C06-8371-479D-973D-591DEB181739",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE42511E-9883-4779-A8E5-FC3E16EF2793",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB06AD21-91A7-46B8-8F44-683828A5422D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48t:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DA169AF-3743-4051-B63B-FF6E1ADCD886",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48u:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D13CF5B-4482-4C7D-8D6A-E220F3E4F868",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48un:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92134C0A-4E5B-43EF-8439-484DF504C43C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300-48uxm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "26ECF9BD-F632-4A02-8993-C0D44B91289C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24p-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "48730DB5-94AF-4BE7-8047-52B8B47CE35A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24p-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3A88142-3284-4C25-8774-36004B5F9087",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24t-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EB76311-4B6D-4897-A683-4244E92BD570",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-24t-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDDA2975-CDB7-4182-A03E-D34F15CDF6F1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48p-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35B9D0B5-4BE1-490E-9A68-00A3D357BC3D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48p-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71FA2F5A-6146-4142-96A8-552118E4BB67",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48t-4g:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEF786D6-F28F-49D8-A15C-BFD0AA934355",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9300l-48t-4x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA32B0AC-1B0A-4ED8-8532-9C7BE6E059D4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9404r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FEFF895-6E4A-4108-BD25-D7DC83154832",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9407r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A485A9A0-2EEC-4C13-846C-0DE2265B2A31",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9410r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B9F1ACA-9D67-4BF0-A357-40D39A61ED00",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-12q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BFEE45F-C5AC-483D-9DE6-4CEB98D80A0C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-16x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD6F5BBC-4627-4A3E-B827-3CEE7EE969D0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-24q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B2E41E2-00CE-42C4-8C91-9307D76F5D7A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-24y4c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "98CB2D23-B5F8-4FA9-8431-3B0124CE2140",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-32c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8A8BA9F-3361-43CD-8031-A5DF0AD68BEB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-32qc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DFE4BB6-FC9A-42B3-B8A0-2610D71BB9B8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-40x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53D13F1D-345D-45D5-9000-DAFE8A85D71B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:catalyst_c9500-48y4c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CFB064E-E390-47B5-AA76-5D3D2E368055",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:csr1000v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62081293-8355-4197-A5A8-1E434B808680",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el sistema de archivos en la USB 3.0 Solid State Drive (SSD) conectable para el Cisco IOS XE Software, podr\u00eda permitir a un atacante f\u00edsico autenticado eliminar el SSD USB 3.0 y modificar \u00e1reas sensibles del sistema de archivos, incluyendo las protecciones del contenedor de espacio de nombres.\u0026#xa0;La vulnerabilidad se produce porque los datos de control del SSD USB 3.0 no se almacenan en la memoria flash de arranque interna.\u0026#xa0;Un atacante podr\u00eda explotar esta vulnerabilidad quitando el SSD USB 3.0, modificando o eliminando archivos en el SSD USB 3.0 usando otro dispositivo y luego reinsertando el SSD USB 3.0 en el dispositivo original.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante eliminar las protecciones del contenedor y realizar acciones de archivos fuera del espacio de nombres del contenedor con privilegios root."
    }
  ],
  "id": "CVE-2020-3396",
  "lastModified": "2024-11-21T05:30:56.857",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.9,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.8,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-24T18:15:17.683",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.