Details of VAR-202006-1077

ID

VAR-202006-1077

CVE

CVE-2020-3210

TITLE

Cisco IOS In software OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-006200

DESCRIPTION

A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated, local attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The attacker must have valid user credentials at privilege level 15. The vulnerability is due to insufficient validation of arguments that are passed to specific VDS-related CLI commands. An attacker could exploit this vulnerability by authenticating to the targeted device and including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user. Cisco IOS The software OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Cisco IOS is a set of operating systems developed by Cisco in the United States for its network equipment

Trust: 2.16

sources: NVD: CVE-2020-3210 // JVNDB: JVNDB-2020-006200 // CNVD: CNVD-2020-31961

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-31961

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(60\)ez16	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.9\(3\)m	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)jaa1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg11a	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.9\(3\)m0a	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)jpj	Trust: 1.0
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	industrial integrated services routers	scope:	eq	version:	809	Trust: 0.6
vendor:	cisco	model:	industrial integrated services routers	scope:	eq	version:	829	Trust: 0.6
vendor:	cisco	model:	series connected grid routers	scope:	eq	version:	1000	Trust: 0.6

sources: CNVD: CNVD-2020-31961 // JVNDB: JVNDB-2020-006200 // NVD: CVE-2020-3210

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-3210
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2020-3210
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2020-006200
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-31961
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202006-309
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-3210
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-006200
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-31961
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:L/AC:L/AU:M/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	2.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-3210
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2020-3210
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	JVNDB-2020-006200
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-31961 // JVNDB: JVNDB-2020-006200 // CNNVD: CNNVD-202006-309 // NVD: CVE-2020-3210 // NVD: CVE-2020-3210

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.8
problemtype:	CWE-77	Trust: 1.0

sources: JVNDB: JVNDB-2020-006200 // NVD: CVE-2020-3210

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202006-309

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202006-309

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-006200

PATCH

title:	cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE	Trust: 0.8
title:	Patch for Cisco 809 Industrial ISRs, 829 Industrial ISRs, and Cisco 1000 Series Connected Grid Routers IOS Software command injection vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/220653	Trust: 0.6
title:	Cisco 809 Industrial ISRs , 829 Industrial ISRs and Cisco 1000 Series Connected Grid Routers IOS Software Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=121140	Trust: 0.6

sources: CNVD: CNVD-2020-31961 // JVNDB: JVNDB-2020-006200 // CNNVD: CNNVD-202006-309

EXTERNAL IDS

db:	NVD	id:	CVE-2020-3210	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-006200	Trust: 0.8
db:	CNVD	id:	CNVD-2020-31961	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.1935	Trust: 0.6
db:	CNNVD	id:	CNNVD-202006-309	Trust: 0.6

sources: CNVD: CNVD-2020-31961 // JVNDB: JVNDB-2020-006200 // CNNVD: CNNVD-202006-309 // NVD: CVE-2020-3210

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-3210	Trust: 2.0
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ios-iot-vds-cmd-inj-vfjtqghe	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3210	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-ios-code-execution-via-cisco-industrial-routers-virtual-device-server-32417	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.1935/	Trust: 0.6

sources: CNVD: CNVD-2020-31961 // JVNDB: JVNDB-2020-006200 // CNNVD: CNNVD-202006-309 // NVD: CVE-2020-3210

SOURCES

db:	CNVD	id:	CNVD-2020-31961
db:	JVNDB	id:	JVNDB-2020-006200
db:	CNNVD	id:	CNNVD-202006-309
db:	NVD	id:	CVE-2020-3210

LAST UPDATE DATE

2024-11-23T21:59:12.029000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-31961	date:	2020-06-09T00:00:00
db:	JVNDB	id:	JVNDB-2020-006200	date:	2020-07-03T00:00:00
db:	CNNVD	id:	CNNVD-202006-309	date:	2020-06-11T00:00:00
db:	NVD	id:	CVE-2020-3210	date:	2024-11-21T05:30:34.053

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-31961	date:	2020-06-09T00:00:00
db:	JVNDB	id:	JVNDB-2020-006200	date:	2020-07-03T00:00:00
db:	CNNVD	id:	CNNVD-202006-309	date:	2020-06-03T00:00:00
db:	NVD	id:	CVE-2020-3210	date:	2020-06-03T18:15:19.073