CVE-2020-3473

CVE	CVE-2020-3473
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-09-04 03:15:00 UTC
Updated	2020-09-09 19:50:00 UTC
Description	A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local CLI shell user to elevate privileges and gain full administrative control of the device. The vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker could exploit this vulnerability by first authenticating to the local CLI shell on the device and using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on the device without authorization checks.

Problem Types: CWE-863

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Cisco	8201	-	All	All	All
Hardware	Cisco	8201	-	All	All	All
Hardware	Cisco	8202	-	All	All	All
Hardware	Cisco	8202	-	All	All	All
Hardware	Cisco	8808	-	All	All	All
Hardware	Cisco	8808	-	All	All	All
Hardware	Cisco	8812	-	All	All	All
Hardware	Cisco	8812	-	All	All	All
Hardware	Cisco	8818	-	All	All	All
Hardware	Cisco	8818	-	All	All	All
Operating System	Cisco	Ios Xr	All	All	All	All
Operating System	Cisco	Ios Xr	All	All	All	All
Hardware	Cisco	Ios Xrv 9000	-	All	All	All
Hardware	Cisco	Ios Xrv 9000	-	All	All	All
Hardware	Cisco	Ncs 4009	-	All	All	All
Hardware	Cisco	Ncs 4009	-	All	All	All
Hardware	Cisco	Ncs 4016	-	All	All	All
Hardware	Cisco	Ncs 4016	-	All	All	All
Hardware	Cisco	Ncs 540	-	All	All	All
Hardware	Cisco	Ncs 540	-	All	All	All
Hardware	Cisco	Ncs 5501	-	All	All	All
Hardware	Cisco	Ncs 5501	-	All	All	All
Hardware	Cisco	Ncs 5501-se	-	All	All	All
Hardware	Cisco	Ncs 5501-se	-	All	All	All
Hardware	Cisco	Ncs 5502	-	All	All	All
Hardware	Cisco	Ncs 5502	-	All	All	All
Hardware	Cisco	Ncs 5502-se	-	All	All	All
Hardware	Cisco	Ncs 5502-se	-	All	All	All
Hardware	Cisco	Ncs 5508	-	All	All	All
Hardware	Cisco	Ncs 5508	-	All	All	All
Hardware	Cisco	Ncs 5516	-	All	All	All
Hardware	Cisco	Ncs 5516	-	All	All	All
Hardware	Cisco	Ncs 560	-	All	All	All
Hardware	Cisco	Ncs 560	-	All	All	All
Hardware	Cisco	Ncs 6000	-	All	All	All
Hardware	Cisco	Ncs 6000	-	All	All	All
Hardware	Cisco	Ncs 6008	-	All	All	All
Hardware	Cisco	Ncs 6008	-	All	All	All

Reference	Source	Link	Tags
Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerability	CISCO	tools.cisco.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

316697 Cisco Internetwork Operating System (IOS) XR Software Authenticated User Privilege Escalation Vulnerability (cisco-sa-iosxr-LJtNFjeN)