CVE-2020-3530
Summary
| CVE | CVE-2020-3530 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-09-04 03:15:00 UTC |
| Updated | 2023-11-07 03:22:00 UTC |
| Description | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that command, even though administrative privileges should be required. The attacker must have valid credentials on the affected device. The vulnerability is due to incorrect mapping in the source code of task group assignments for a specific command. An attacker could exploit this vulnerability by issuing the command, which they should not be authorized to issue, on an affected device. A successful exploit could allow the attacker to invalidate the integrity of the disk and cause the device to restart. This vulnerability could allow a user with read permissions to issue a specific command that should require Administrator privileges. |
Risk And Classification
Problem Types: CWE-863
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | Asr 9000v | - | All | All | All |
| Hardware | Cisco | Asr 9000v | - | All | All | All |
| Hardware | Cisco | Asr 9001 | - | All | All | All |
| Hardware | Cisco | Asr 9001 | - | All | All | All |
| Hardware | Cisco | Asr 9006 | - | All | All | All |
| Hardware | Cisco | Asr 9006 | - | All | All | All |
| Hardware | Cisco | Asr 9010 | - | All | All | All |
| Hardware | Cisco | Asr 9010 | - | All | All | All |
| Hardware | Cisco | Asr 9901 | - | All | All | All |
| Hardware | Cisco | Asr 9901 | - | All | All | All |
| Hardware | Cisco | Asr 9904 | - | All | All | All |
| Hardware | Cisco | Asr 9904 | - | All | All | All |
| Hardware | Cisco | Asr 9906 | - | All | All | All |
| Hardware | Cisco | Asr 9906 | - | All | All | All |
| Hardware | Cisco | Asr 9910 | - | All | All | All |
| Hardware | Cisco | Asr 9910 | - | All | All | All |
| Hardware | Cisco | Asr 9912 | - | All | All | All |
| Hardware | Cisco | Asr 9912 | - | All | All | All |
| Hardware | Cisco | Asr 9922 | - | All | All | All |
| Hardware | Cisco | Asr 9922 | - | All | All | All |
| Operating System | Cisco | Ios Xr | All | All | All | All |
| Operating System | Cisco | Ios Xr | All | All | All | All |
| Hardware | Cisco | Ncs 1001 | - | All | All | All |
| Hardware | Cisco | Ncs 1001 | - | All | All | All |
| Hardware | Cisco | Ncs 1002 | - | All | All | All |
| Hardware | Cisco | Ncs 1002 | - | All | All | All |
| Hardware | Cisco | Ncs 1004 | - | All | All | All |
| Hardware | Cisco | Ncs 1004 | - | All | All | All |
| Hardware | Cisco | Ncs 5001 | - | All | All | All |
| Hardware | Cisco | Ncs 5001 | - | All | All | All |
| Hardware | Cisco | Ncs 5002 | - | All | All | All |
| Hardware | Cisco | Ncs 5002 | - | All | All | All |
| Hardware | Cisco | Ncs 5011 | - | All | All | All |
| Hardware | Cisco | Ncs 5011 | - | All | All | All |
| Hardware | Cisco | Ncs 5501 | - | All | All | All |
| Hardware | Cisco | Ncs 5501 | - | All | All | All |
| Hardware | Cisco | Ncs 5501-se | - | All | All | All |
| Hardware | Cisco | Ncs 5501-se | - | All | All | All |
| Hardware | Cisco | Ncs 5502 | - | All | All | All |
| Hardware | Cisco | Ncs 5502 | - | All | All | All |
| Hardware | Cisco | Ncs 5502-se | - | All | All | All |
| Hardware | Cisco | Ncs 5502-se | - | All | All | All |
| Hardware | Cisco | Ncs 5508 | - | All | All | All |
| Hardware | Cisco | Ncs 5508 | - | All | All | All |
| Hardware | Cisco | Ncs 5516 | - | All | All | All |
| Hardware | Cisco | Ncs 5516 | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco IOS XR Authenticated User Privilege Escalation Vulnerability | CISCO | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 316785 Cisco Internetwork Operating System (IOS) XR Authenticated User Privilege Escalation Vulnerability (cisco-sa-iosxr-cli-privescl-sDVEmhqv)