CVE-2020-3476CWE-552

Cisco IOS XE Software Arbitrary File Overwrite Vulnerability

Medium · published September 24, 2020

CVSS v3.0
4.4
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

A vulnerability in the CLI implementation of a specific command of Cisco IOS XE Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying host file system. The vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of any arbitrary file that resides on the underlying host file system.

The record
Technical detail
CVSS v3.0
4.4 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2020-09-24T17:52Z
EPSS history
Timeline
  • 24 SEP 17:52Z
    Cisco IOS XE Software Arbitrary File Overwrite Vulnerability
    cvelistv5