Sign-up

ID

VAR-202005-0709


CVE

CVE-2020-3309


TITLE

Cisco Firepower Device Manager On-Box Out-of-bounds write vulnerabilities in software

Trust: 0.8

sources: JVNDB: JVNDB-2020-005221

DESCRIPTION

A vulnerability in Cisco Firepower Device Manager (FDM) On-Box software could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by uploading a malicious file to an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on as well as modify the underlying operating system of an affected device. (DoS) It may be put into a state. Cisco Firepower Device Manager (FDM) is a firewall device manager of Cisco (Cisco). The product supports access rule configuration, system monitoring and other functions

Trust: 1.8

sources: NVD: CVE-2020-3309 // JVNDB: JVNDB-2020-005221 // VULHUB: VHN-181434 // VULMON: CVE-2020-3309

AFFECTED PRODUCTS

vendor:ciscomodel:firepower device manager on-boxscope:ltversion:6.2.3

Trust: 1.0

vendor:ciscomodel:firepower device manager on-box softwarescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-005221 // NVD: CVE-2020-3309

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3309
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3309
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-005221
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202005-186
value: HIGH

Trust: 0.6

VULHUB: VHN-181434
value: HIGH

Trust: 0.1

VULMON: CVE-2020-3309
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-3309
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-005221
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-181434
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-3309
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3309
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.2
version: 3.0

Trust: 1.0

NVD: JVNDB-2020-005221
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-181434 // VULMON: CVE-2020-3309 // JVNDB: JVNDB-2020-005221 // CNNVD: CNNVD-202005-186 // NVD: CVE-2020-3309 // NVD: CVE-2020-3309

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.9

problemtype:CWE-20

Trust: 1.0

sources: VULHUB: VHN-181434 // JVNDB: JVNDB-2020-005221 // NVD: CVE-2020-3309

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202005-186

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202005-186

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-005221

PATCH
title:cisco-sa-fdmfo-HvPWKxDeurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fdmfo-HvPWKxDe
Trust: 0.8
title:Cisco Firepower Device Manager On-Box software Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=118787
Trust: 0.6
title:Cisco: Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-fdmfo-HvPWKxDe
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-3309 // 
            
            
            
            JVNDB: JVNDB-2020-005221 // 
            
            
            
            CNNVD: CNNVD-202005-186

EXTERNAL IDS
db:NVDid:CVE-2020-3309
Trust: 2.6
db:JVNDBid:JVNDB-2020-005221
Trust: 0.8
db:CNNVDid:CNNVD-202005-186
Trust: 0.7
db:AUSCERTid:ESB-2020.1614
Trust: 0.6
db:AUSCERTid:ESB-2020.1614.2
Trust: 0.6
db:VULHUBid:VHN-181434
Trust: 0.1
db:VULMONid:CVE-2020-3309
Trust: 0.1
sources:
            
            
            VULHUB: VHN-181434 // 
            
            
            
            VULMON: CVE-2020-3309 // 
            
            
            
            JVNDB: JVNDB-2020-005221 // 
            
            
            
            CNNVD: CNNVD-202005-186 // 
            
            
            
            NVD: CVE-2020-3309

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-fdmfo-hvpwkxde
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2020-3309
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3309
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2020.1614/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.1614.2/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/787.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/181515
Trust: 0.1
sources:
            
            
            VULHUB: VHN-181434 // 
            
            
            
            VULMON: CVE-2020-3309 // 
            
            
            
            JVNDB: JVNDB-2020-005221 // 
            
            
            
            CNNVD: CNNVD-202005-186 // 
            
            
            
            NVD: CVE-2020-3309

SOURCES
db:VULHUBid:VHN-181434
db:VULMONid:CVE-2020-3309
db:JVNDBid:JVNDB-2020-005221
db:CNNVDid:CNNVD-202005-186
db:NVDid:CVE-2020-3309

LAST UPDATE DATE
2024-08-14T14:03:47.481000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-181434date:2020-05-12T00:00:00
db:VULMONid:CVE-2020-3309date:2020-05-12T00:00:00
db:JVNDBid:JVNDB-2020-005221date:2020-06-09T00:00:00
db:CNNVDid:CNNVD-202005-186date:2020-05-15T00:00:00
db:NVDid:CVE-2020-3309date:2020-05-12T17:24:15.140

SOURCES RELEASE DATE
db:VULHUBid:VHN-181434date:2020-05-06T00:00:00
db:VULMONid:CVE-2020-3309date:2020-05-06T00:00:00
db:JVNDBid:JVNDB-2020-005221date:2020-06-09T00:00:00
db:CNNVDid:CNNVD-202005-186date:2020-05-06T00:00:00
db:NVDid:CVE-2020-3309date:2020-05-06T17:15:13.463