Vulnerabilities > CVE-2020-3396 - Improper Privilege Management vulnerability in Cisco IOS XE 16.12.1

CVSS 7.2 - HIGH

Attack vector

PHYSICAL

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

low complexity

cisco

CWE-269

NVD

Published: 2020-09-24

Updated: 2023-11-07

Summary

A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE 16.12.1	1
Hardware	Cisco Cisco 1100 4G Integrated Services Router - Cisco 1100 4Gltegb Integrated Services Router - Cisco 1100 4Gltena Integrated Services Router - Cisco 1100 6G Integrated Services Router - Cisco 1100 LTE Integrated Services Router - Cisco 1100 Integrated Services Router - Cisco 4321/K9 RF Integrated Services Router - Cisco 4321/K9 WS Integrated Services Router - Cisco 4321/K9 Integrated Services Router - Cisco 4331/K9 RF Integrated Services Router - Cisco 4331/K9 WS Integrated Services Router - Cisco 4331/K9 Integrated Services Router - Cisco 4351/K9 RF Integrated Services Router - Cisco 4351/K9 WS Integrated Services Router - Cisco 4351/K9 Integrated Services Router - Cisco ASR 1000 X - Cisco ASR 1001 - Cisco ASR 1001 X - Cisco ASR 1002 - Cisco ASR 1002 X - Cisco ASR 1004 - Cisco ASR 1006 - Cisco ASR 1013 - Cisco ASR 1023 - Cisco Catalyst C9300 24P - Cisco Catalyst C9300 24S - Cisco Catalyst C9300 24T - Cisco Catalyst C9300 24U - Cisco Catalyst C9300 24Ux - Cisco Catalyst C9300 48P - Cisco Catalyst C9300 48S - Cisco Catalyst C9300 48T - Cisco Catalyst C9300 48U - Cisco Catalyst C9300 48Un - Cisco Catalyst C9300 48Uxm - Cisco Catalyst C9300L 24P 4G - Cisco Catalyst C9300L 24P 4X - Cisco Catalyst C9300L 24T 4G - Cisco Catalyst C9300L 24T 4X - Cisco Catalyst C9300L 48P 4G - Cisco Catalyst C9300L 48P 4X - Cisco Catalyst C9300L 48T 4G - Cisco Catalyst C9300L 48T 4X - Cisco Catalyst C9404R - Cisco Catalyst C9407R - Cisco Catalyst C9410R - Cisco Catalyst C9500 12Q - Cisco Catalyst C9500 16X - Cisco Catalyst C9500 24Q - Cisco Catalyst C9500 24Y4C - Cisco Catalyst C9500 32C - Cisco Catalyst C9500 32Qc - Cisco Catalyst C9500 40X - Cisco Catalyst C9500 48Y4C - Cisco Csr1000V -	55

Common Weakness Enumeration (CWE)

CWE-269 - Improper Privilege Management

Common Attack Pattern Enumeration and Classification (CAPEC)

Restful Privilege Elevation
Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj