Vulnerabilities > CVE-2020-3404 - Incorrect Authorization vulnerability in Cisco IOS XE 16.11.1

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

cisco

CWE-863

NVD

Published: 2020-09-24

Updated: 2023-05-23

Summary

A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the persistent Telnet/SSH CLI on an affected device and requesting shell access. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS with root privileges.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco IOS XE 16.11.1	1
Hardware	Cisco Cisco 1100 4G Integrated Services Router - Cisco 1100 4Gltegb Integrated Services Router - Cisco 1100 4Gltena Integrated Services Router - Cisco 1100 4P Integrated Services Router - Cisco 1100 6G Integrated Services Router - Cisco 1100 8P Integrated Services Router - Cisco 1100 LTE Integrated Services Router - Cisco 1100 Integrated Services Router - Cisco 1101 4P Integrated Services Router - Cisco 1101 Integrated Services Router - Cisco 1109 2P Integrated Services Router - Cisco 1109 4P Integrated Services Router - Cisco 1109 Integrated Services Router - Cisco 1111X 8P Integrated Services Router - Cisco 1111X Integrated Services Router - Cisco 111X Integrated Services Router - Cisco 1120 Integrated Services Router - Cisco 1160 Integrated Services Router - Cisco 4221 Integrated Services Router - Cisco 4331 Integrated Services Router - Cisco 4431 Integrated Services Router - Cisco 4451 Integrated Services Router - Cisco 4461 Integrated Services Router - Cisco ASR 1000 X - Cisco ASR 1001 - Cisco ASR 1001 X - Cisco ASR 1002 - Cisco ASR 1002 X - Cisco ASR 1004 - Cisco ASR 1006 - Cisco ASR 1013 - Cisco Asr1001 HX - Cisco Asr1001 HX RF - Cisco Asr1001 X RF - Cisco Asr1001 X WS - Cisco Asr1002 HX - Cisco Asr1002 HX RF - Cisco Asr1002 HX WS - Cisco Asr1002 X RF - Cisco Asr1002 X WS - Cisco Catalyst 9800 40 - Cisco Catalyst 9800 80 - Cisco Catalyst 9800 CL - Cisco Catalyst 9800 L - Cisco Catalyst 9800 L C - Cisco Catalyst 9800 L F - Cisco Catalyst C9200 24P - Cisco Catalyst C9200 24T - Cisco Catalyst C9200 48P - Cisco Catalyst C9200 48T - Cisco Catalyst C9200L 24P 4G - Cisco Catalyst C9200L 24P 4X - Cisco Catalyst C9200L 24Pxg 2Y - Cisco Catalyst C9200L 24Pxg 4X - Cisco Catalyst C9200L 24T 4G - Cisco Catalyst C9200L 24T 4X - Cisco Catalyst C9200L 48P 4G - Cisco Catalyst C9200L 48P 4X - Cisco Catalyst C9200L 48Pxg 2Y - Cisco Catalyst C9200L 48Pxg 4X - Cisco Catalyst C9200L 48T 4G - Cisco Catalyst C9200L 48T 4X - Cisco Catalyst C9300 24P - Cisco Catalyst C9300 24S - Cisco Catalyst C9300 24T - Cisco Catalyst C9300 24U - Cisco Catalyst C9300 24Ux - Cisco Catalyst C9300 48P - Cisco Catalyst C9300 48S - Cisco Catalyst C9300 48T - Cisco Catalyst C9300 48U - Cisco Catalyst C9300 48Un - Cisco Catalyst C9300 48Uxm - Cisco Catalyst C9300L 24P 4G - Cisco Catalyst C9300L 24P 4X - Cisco Catalyst C9300L 24T 4G - Cisco Catalyst C9300L 24T 4X - Cisco Catalyst C9300L 48P 4G - Cisco Catalyst C9300L 48P 4X - Cisco Catalyst C9300L 48T 4G - Cisco Catalyst C9300L 48T 4X - Cisco Catalyst C9404R - Cisco Catalyst C9407R - Cisco Catalyst C9410R - Cisco Catalyst C9500 12Q - Cisco Catalyst C9500 16X - Cisco Catalyst C9500 24Q - Cisco Catalyst C9500 24Y4C - Cisco Catalyst C9500 32C - Cisco Catalyst C9500 32Qc - Cisco Catalyst C9500 40X - Cisco Catalyst C9500 48Y4C - Cisco CSR 1000V * Cisco WS C3650 12X48Uq - Cisco WS C3650 12X48Ur - Cisco WS C3650 12X48Uz - Cisco WS C3650 24Pd - Cisco WS C3650 24Pdm - Cisco WS C3650 24Ps - Cisco WS C3650 24Td - Cisco WS C3650 24Ts - Cisco WS C3650 48Fd - Cisco WS C3650 48Fq - Cisco WS C3650 48Fqm - Cisco WS C3650 48Fs - Cisco WS C3650 48Pd - Cisco WS C3650 48Pq - Cisco WS C3650 48Ps - Cisco WS C3650 48Td - Cisco WS C3650 48Tq - Cisco WS C3650 48Ts - Cisco WS C3650 8X24Uq - Cisco WS C3850 - Cisco WS C3850 12S - Cisco WS C3850 12X48U - Cisco WS C3850 12Xs - Cisco WS C3850 24P - Cisco WS C3850 24S - Cisco WS C3850 24T - Cisco WS C3850 24U - Cisco WS C3850 24Xs - Cisco WS C3850 24Xu - Cisco WS C3850 48F - Cisco WS C3850 48P - Cisco WS C3850 48T - Cisco WS C3850 48U - Cisco WS C3850 48Xs -	127

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ctbypass-7QHAfHkK