Lucene search

CiscoCVELIST:CVE-2020-3516

HistorySep 24, 2020 - 5:51 p.m.

CVE-2020-3516 Cisco IOS XE Software Web UI Improper Input Validation Vulnerability

2020-09-2417:51:26

CWE-20

cisco

www.cve.org

cisco

ios

web server

input validation

authentication

remote attacker

web ui

vulnerability

exploit

crash

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticated, remote attacker to crash the web server on the device. The vulnerability is due to insufficient input validation during authentication. An attacker could exploit this vulnerability by entering unexpected characters during a valid authentication. A successful exploit could allow the attacker to crash the web server on the device, which must be manually recovered by disabling and re-enabling the web server.

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-WEB-UI-exNFmcPO

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

Related for CVELIST:CVE-2020-3516