Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (Cisco Cisco IOS XR Software)

CVE-2020-3364

MEDIUM 5.3

En bref

Source: NVD
EPSS: EPSS 0.91 % · centile 60 (2026-10-29)
État: PUBLISHED
Publiée: 2020-06-18 02:17 UTC
Mise à jour: 2024-11-15 17:00 UTC
Attribuée par: cisco
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XR Software, which prevents the ACL from working when applied against the standby route processor management interface. An attacker could exploit this vulnerability by attempting to access the device through the standby route processor management interface.

Faiblesses (CWE)

CWE-284 — Contrôle d'accès incorrect
CWE-863 — Autorisation incorrecte

Références

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xracl-zbWSWREt

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	MEDIUM 5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	cisco
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.0	MEDIUM 5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	NVD · psirt@cisco.com (Secondary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2020-24635
GCVE · GCVE-0-2020-3364

Configurations affectées (CPE NVD)

cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.0.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.0.11:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.0.12:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.1.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.1.15:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Cisco · Cisco IOS XR Software	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (Cisco Cisco IOS XR Software)