CVE-2020-3171
Summary
| CVE | CVE-2020-3171 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-02-26 17:15:00 UTC |
| Updated | 2020-03-03 21:13:00 UTC |
| Description | A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted arguments to specific commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in user for all affected platforms excluding Cisco UCS 6400 Series Fabric Interconnects. On Cisco UCS 6400 Series Fabric Interconnects, the injected commands are executed with root privileges. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | Firepower 2110 | - | All | All | All |
| Hardware | Cisco | Firepower 2110 | - | All | All | All |
| Hardware | Cisco | Firepower 2120 | - | All | All | All |
| Hardware | Cisco | Firepower 2120 | - | All | All | All |
| Hardware | Cisco | Firepower 2130 | - | All | All | All |
| Hardware | Cisco | Firepower 2130 | - | All | All | All |
| Hardware | Cisco | Firepower 2140 | - | All | All | All |
| Hardware | Cisco | Firepower 2140 | - | All | All | All |
| Hardware | Cisco | Firepower 4110 | - | All | All | All |
| Hardware | Cisco | Firepower 4110 | - | All | All | All |
| Hardware | Cisco | Firepower 4115 | - | All | All | All |
| Hardware | Cisco | Firepower 4115 | - | All | All | All |
| Hardware | Cisco | Firepower 4120 | - | All | All | All |
| Hardware | Cisco | Firepower 4120 | - | All | All | All |
| Hardware | Cisco | Firepower 4125 | - | All | All | All |
| Hardware | Cisco | Firepower 4125 | - | All | All | All |
| Hardware | Cisco | Firepower 4140 | - | All | All | All |
| Hardware | Cisco | Firepower 4140 | - | All | All | All |
| Hardware | Cisco | Firepower 4145 | - | All | All | All |
| Hardware | Cisco | Firepower 4145 | - | All | All | All |
| Hardware | Cisco | Firepower 4150 | - | All | All | All |
| Hardware | Cisco | Firepower 4150 | - | All | All | All |
| Hardware | Cisco | Firepower 9300 | - | All | All | All |
| Hardware | Cisco | Firepower 9300 | - | All | All | All |
| Operating System | Cisco | Fxos | 2.4\(1.214\) | All | All | All |
| Operating System | Cisco | Fxos | 2.4\(1.216\) | All | All | All |
| Operating System | Cisco | Fxos | 2.4\(1.214\) | All | All | All |
| Operating System | Cisco | Fxos | 2.4\(1.216\) | All | All | All |
| Hardware | Cisco | Ucs 6248up | - | All | All | All |
| Hardware | Cisco | Ucs 6248up | - | All | All | All |
| Hardware | Cisco | Ucs 6296up | - | All | All | All |
| Hardware | Cisco | Ucs 6296up | - | All | All | All |
| Hardware | Cisco | Ucs 6324 | - | All | All | All |
| Hardware | Cisco | Ucs 6324 | - | All | All | All |
| Hardware | Cisco | Ucs 6332 | - | All | All | All |
| Hardware | Cisco | Ucs 6332 | - | All | All | All |
| Hardware | Cisco | Ucs 6332-16up | - | All | All | All |
| Hardware | Cisco | Ucs 6332-16up | - | All | All | All |
| Hardware | Cisco | Ucs 64108 | - | All | All | All |
| Hardware | Cisco | Ucs 64108 | - | All | All | All |
| Hardware | Cisco | Ucs 6454 | - | All | All | All |
| Hardware | Cisco | Ucs 6454 | - | All | All | All |
| Application | Cisco | Ucs Manager | 4.0\(1a\)a | All | All | All |
| Application | Cisco | Ucs Manager | 4.0\(1a\)a | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco FXOS and UCS Manager Software Local Management CLI Command Injection Vulnerability | CISCO | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.