CVE-2020-3393 (CNNVD-202009-1391)
中文标题:
Cisco IOS 输入验证错误漏洞
英文标题:
Cisco IOS XE Software IOx Application Hosting Privilege Escalation Vulnerability
漏洞描述
中文描述:
Cisco IOS是美国思科（Cisco）公司的一套为其网络设备开发的操作系统。 Cisco IOS XE application-hosting subsystem存在安全漏洞，该漏洞源于两个因素共同导致的：（a）CLI命令的用户有效负载的输入验证不完整；（b）当在应用程序中的命令行处发布命令时，基于角色的访问控制（RBAC）不正确- 托管子系统。 攻击者可利用该漏洞结合使用CLI命令和精心设计的用户输入。
英文描述:
A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem Docker container as well as on the underlying Linux operating system. These commands could be run as the root user. The vulnerability is due to a combination of two factors: (a) incomplete input validation of the user payload of CLI commands, and (b) improper role-based access control (RBAC) when commands are issued at the command line within the application-hosting subsystem. An attacker could exploit this vulnerability by using a CLI command with crafted user input. A successful exploit could allow the lower-privileged attacker to execute arbitrary CLI commands with root privileges. The attacker would need valid user credentials to exploit this vulnerability.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco IOS XE Software | n/a | - | - |
cpe:2.3:a:cisco:cisco_ios_xe_software:n_a:*:*:*:*:*:*:*
|
| cisco | ios_xe | 16.12.1 | - | - |
cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2020-3393 |
2025-11-11 15:20:37 | 2025-11-11 07:36:19 |
| NVD | nvd_CVE-2020-3393 |
2025-11-11 14:57:03 | 2025-11-11 07:44:43 |
| CNNVD | cnnvd_CNNVD-202009-1391 |
2025-11-11 15:10:30 | 2025-11-11 07:56:26 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 输入验证错误
- cnnvd_id: 未提取 -> CNNVD-202009-1391
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']