CVE-2020-3167 - Cisco FXOS and UCS Manager Software CLI Command Injection Vulnerability

Back Back to CVE browser

HIGH

Cisco FXOS and UCS Manager Software CLI Command Injection Vulnerability

Published Feb 26, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.90%

Description

A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS). The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted arguments to specific commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in user for all affected platforms excluding Cisco UCS 6400 Series Fabric Interconnects. On Cisco UCS 6400 Series Fabric Interconnects, the injected commands are executed with root privileges.

Affected products

Vendor Cisco Product Cisco Adaptive Security Appliance (ASA) Software Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Adaptive Security Appliance (ASA) Software

n/a

Version	Status	Constraints
unspecified	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24438
Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-ucs-cmdinj
vendor-advisoryx_refsource_CISCOVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24438		Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fxos-ucs-cmdinj		vendor-advisoryx_refsource_CISCOVendor Advisory