Vulnerabilities > CVE-2020-3425 - Unspecified vulnerability in Cisco IOS XE

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

cisco

NVD

Published: 2020-09-24

Updated: 2023-11-07

Summary

Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE 16.1.1 Cisco IOS XE 16.1.2 Cisco IOS XE 16.1.3 Cisco IOS XE 16.2.1 Cisco IOS XE 16.2.2 Cisco IOS XE 16.3.1 Cisco IOS XE 16.3.1A Cisco IOS XE 16.3.2 Cisco IOS XE 16.3.3 Cisco IOS XE 16.3.4 Cisco IOS XE 16.3.5 Cisco IOS XE 16.3.5B Cisco IOS XE 16.3.6 Cisco IOS XE 16.3.7 Cisco IOS XE 16.3.8 Cisco IOS XE 16.3.9 Cisco IOS XE 16.3.10 Cisco IOS XE 16.4.1 Cisco IOS XE 16.4.2 Cisco IOS XE 16.4.3 Cisco IOS XE 16.5.1 Cisco IOS XE 16.5.1A Cisco IOS XE 16.5.1B Cisco IOS XE 16.5.2 Cisco IOS XE 16.5.3 Cisco IOS XE 16.6.1 Cisco IOS XE 16.6.2 Cisco IOS XE 16.6.3 Cisco IOS XE 16.6.4 Cisco IOS XE 16.6.4A Cisco IOS XE 16.6.4S Cisco IOS XE 16.6.5 Cisco IOS XE 16.6.5A Cisco IOS XE 16.6.5B Cisco IOS XE 16.6.6 Cisco IOS XE 16.6.7 Cisco IOS XE 16.6.7A Cisco IOS XE 16.6.8 Cisco IOS XE 16.7.1 Cisco IOS XE 16.7.1A Cisco IOS XE 16.7.1B Cisco IOS XE 16.7.2 Cisco IOS XE 16.7.3 Cisco IOS XE 16.7.4 Cisco IOS XE 16.8.1 Cisco IOS XE 16.8.1A Cisco IOS XE 16.8.1B Cisco IOS XE 16.8.1C Cisco IOS XE 16.8.1D Cisco IOS XE 16.8.1E Cisco IOS XE 16.8.1S Cisco IOS XE 16.8.2 Cisco IOS XE 16.8.3 Cisco IOS XE 16.9.1 Cisco IOS XE 16.9.1A Cisco IOS XE 16.9.1B Cisco IOS XE 16.9.1C Cisco IOS XE 16.9.1D Cisco IOS XE 16.9.1S Cisco IOS XE 16.9.2 Cisco IOS XE 16.9.2A Cisco IOS XE 16.9.2S Cisco IOS XE 16.9.3 Cisco IOS XE 16.9.3A Cisco IOS XE 16.9.3H Cisco IOS XE 16.9.3S Cisco IOS XE 16.9.4 Cisco IOS XE 16.9.4C Cisco IOS XE 16.9.5 Cisco IOS XE 16.9.5F Cisco IOS XE 16.10.1 Cisco IOS XE 16.10.1A Cisco IOS XE 16.10.1B Cisco IOS XE 16.10.1C Cisco IOS XE 16.10.1D Cisco IOS XE 16.10.1E Cisco IOS XE 16.10.1F Cisco IOS XE 16.10.1G Cisco IOS XE 16.10.1S Cisco IOS XE 16.10.2 Cisco IOS XE 16.10.3 Cisco IOS XE 16.11.1 Cisco IOS XE 16.11.1A Cisco IOS XE 16.11.1B Cisco IOS XE 16.11.1C Cisco IOS XE 16.11.1S Cisco IOS XE 16.11.2 Cisco IOS XE 16.12.1 Cisco IOS XE 16.12.1A Cisco IOS XE 16.12.1C Cisco IOS XE 16.12.1S Cisco IOS XE 16.12.1T Cisco IOS XE 16.12.1W Cisco IOS XE 16.12.1X Cisco IOS XE 16.12.1Y Cisco IOS XE 16.12.2 Cisco IOS XE 16.12.2A Cisco IOS XE 16.12.2S Cisco IOS XE 16.12.2T Cisco IOS XE 17.1.1 Cisco IOS XE 17.1.1A Cisco IOS XE 17.1.1S Cisco IOS XE 17.1.1T Cisco IOS XE 17.2.1 Cisco IOS XE 17.2.1A Cisco IOS XE 17.2.1R Cisco IOS XE 17.2.1V	107
Hardware	Cisco Cisco 1100 Integrated Services Router - Cisco 1101 Integrated Services Router - Cisco 1109 Integrated Services Router - Cisco 1111X Integrated Services Router - Cisco 111X Integrated Services Router - Cisco 1120 Integrated Services Router - Cisco 1160 Integrated Services Router - Cisco 4221 Integrated Services Router - Cisco 4321 Integrated Services Router - Cisco 4331 Integrated Services Router - Cisco 4351 Integrated Services Router - Cisco 4431 Integrated Services Router - Cisco 4451 X Integrated Services Router - Cisco 4461 Integrated Services Router - Cisco ASR 1001 HX - Cisco ASR 1001 X - Cisco ASR 1002 HX - Cisco ASR 1002 X - Cisco ASR 1004 - Cisco ASR 1006 - Cisco ASR 1006 X - Cisco ASR 1009 X - Cisco ASR 1013 - Cisco Catalyst 9800 40 - Cisco Catalyst 9800 80 - Cisco Catalyst 9800 CL - Cisco Catalyst 9800 L - Cisco Catalyst 9800 L C - Cisco Catalyst 9800 L F - Cisco Catalyst C9200 24P - Cisco Catalyst C9200 24T - Cisco Catalyst C9200 48P - Cisco Catalyst C9200 48T - Cisco Catalyst C9200L 24P 4G - Cisco Catalyst C9200L 24P 4X - Cisco Catalyst C9200L 24Pxg 2Y - Cisco Catalyst C9200L 24Pxg 4X - Cisco Catalyst C9200L 24T 4G - Cisco Catalyst C9200L 24T 4X - Cisco Catalyst C9200L 48P 4G - Cisco Catalyst C9200L 48P 4X - Cisco Catalyst C9200L 48Pxg 2Y - Cisco Catalyst C9200L 48Pxg 4X - Cisco Catalyst C9200L 48T 4G - Cisco Catalyst C9200L 48T 4X - Cisco Catalyst C9300 24P - Cisco Catalyst C9300 24S - Cisco Catalyst C9300 24T - Cisco Catalyst C9300 24U - Cisco Catalyst C9300 24Ux - Cisco Catalyst C9300 48P - Cisco Catalyst C9300 48S - Cisco Catalyst C9300 48T - Cisco Catalyst C9300 48U - Cisco Catalyst C9300 48Un - Cisco Catalyst C9300 48Uxm - Cisco Catalyst C9300L 24P 4G - Cisco Catalyst C9300L 24P 4X - Cisco Catalyst C9300L 24T 4G - Cisco Catalyst C9300L 24T 4X - Cisco Catalyst C9300L 48P 4G - Cisco Catalyst C9300L 48P 4X - Cisco Catalyst C9300L 48T 4G - Cisco Catalyst C9300L 48T 4X - Cisco Catalyst C9500 12Q - Cisco Catalyst C9500 16X - Cisco Catalyst C9500 24Q - Cisco Catalyst C9500 24Y4C - Cisco Catalyst C9500 32C - Cisco Catalyst C9500 32Qc - Cisco Catalyst C9500 40X - Cisco Catalyst C9500 48Y4C - Cisco Cloud Services Router 1000V - Cisco Integrated Services Virtual Router - Cisco WS C3650 12X48Uq - Cisco WS C3650 12X48Ur - Cisco WS C3650 12X48Uz - Cisco WS C3650 24Pd - Cisco WS C3650 24Pdm - Cisco WS C3650 24Ps - Cisco WS C3650 24Td - Cisco WS C3650 24Ts - Cisco WS C3650 48Fd - Cisco WS C3650 48Fq - Cisco WS C3650 48Fqm - Cisco WS C3650 48Fs - Cisco WS C3650 48Pd - Cisco WS C3650 48Pq - Cisco WS C3650 48Ps - Cisco WS C3650 48Td - Cisco WS C3650 48Tq - Cisco WS C3650 48Ts - Cisco WS C3650 8X24Uq - Cisco WS C3850 - Cisco WS C3850 12S - Cisco WS C3850 12X48U - Cisco WS C3850 12Xs - Cisco WS C3850 24P - Cisco WS C3850 24S - Cisco WS C3850 24T - Cisco WS C3850 24U - Cisco WS C3850 24Xs - Cisco WS C3850 24Xu - Cisco WS C3850 48F - Cisco WS C3850 48P - Cisco WS C3850 48T - Cisco WS C3850 48U - Cisco WS C3850 48Xs - Cisco WS C3860 -	109

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-webui-priv-esc-K8zvEWM