CVE-2020-3121 : A vulnerability in the web-based management interface of Cisco Small Business Sm

A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and access a specific page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Published 2020-01-26 05:15:17

Updated 2020-01-31 17:32:24

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2020-3121

Cisco » Sg350-10 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg350-10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg350-10 » Version: N/A
Cisco » Sg350-10p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg350-10p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg350-10p » Version: N/A
Cisco » Sg350-10mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg350-10mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg350-10mp » Version: N/A
Cisco » Sg350-28 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg350-28_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg350-28 » Version: N/A
Cisco » Sg350-28p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg350-28p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg350-28p » Version: N/A
Cisco » Sg350-28mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg350-28mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg350-28mp » Version: N/A
Cisco » Sf350-48 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf350-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf350-48 » Version: N/A
Cisco » Sf350-48p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf350-48p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf350-48p » Version: N/A
Cisco » Sf350-48mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf350-48mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf350-48mp » Version: N/A
Cisco » Sx550x-16ft Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sx550x-16ft_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sx550x-16ft » Version: N/A
Cisco » Sx550x-24ft Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sx550x-24ft_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sx550x-24ft » Version: N/A
Cisco » Sx550x-24 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sx550x-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sx550x-24 » Version: N/A
Cisco » Sx550x-52 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sx550x-52_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sx550x-52 » Version: N/A
Cisco » Sg550x-24 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-24 » Version: N/A
Cisco » Sg550x-24p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-24p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-24p » Version: N/A
Cisco » Sg550x-24mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-24mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-24mp » Version: N/A
Cisco » Sg550x-24mpp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-24mpp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-24mpp » Version: N/A
Cisco » Sg550x-48 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-48 » Version: N/A
Cisco » Sg550x-48p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-48p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-48p » Version: N/A
Cisco » Sg550x-48mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg550x-48mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg550x-48mp » Version: N/A
Cisco » Sf550x-24 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf550x-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf550x-24 » Version: N/A
Cisco » Sf550x-24p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf550x-24p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf550x-24p » Version: N/A
Cisco » Sf550x-48 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf550x-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf550x-48 » Version: N/A
Cisco » Sf550x-48p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf550x-48p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf550x-48p » Version: N/A
Cisco » Sf550x-48mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sf550x-48mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sf550x-48mp » Version: N/A
Cisco » Sg250x-24 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250x-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250x-24 » Version: N/A
Cisco » Sg250x-24p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250x-24p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250x-24p » Version: N/A
Cisco » Sg250x-48 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250x-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250x-48 » Version: N/A
Cisco » Sg250x-48p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250x-48p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250x-48p » Version: N/A
Cisco » Sg250-08 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-08_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-08 » Version: N/A
Cisco » Sg250-08hp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-08hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-08hp » Version: N/A
Cisco » Sg250-10p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-10p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-10p » Version: N/A
Cisco » Sg250-18 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-18_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-18 » Version: N/A
Cisco » Sg250-26 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-26_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-26 » Version: N/A
Cisco » Sg250-26hp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-26hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-26hp » Version: N/A
Cisco » Sg250-26p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-26p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-26p » Version: N/A
Cisco » Sg250-50 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-50 » Version: N/A
Cisco » Sg250-50hp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-50hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-50hp » Version: N/A
Cisco » Sg250-50p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-50p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-50p » Version: N/A
Cisco » Sg250-24 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-24 » Version: N/A
Cisco » Sg250-24p Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-24p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-24p » Version: N/A
Cisco » Sg250-48 Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-48 » Version: N/A
Cisco » Sg250-48hp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg250-48hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg250-48hp » Version: N/A
Cisco » Sg355-10mp Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sg355-10mp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sg355-10mp » Version: N/A
Cisco » Sx550x-12ft Firmware
Versions up to, including, (<=) 2.5.0.90
cpe:2.3:o:cisco:sx550x-12ft_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Sx550x-12ft » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-3121

EPSS FAQ

0.32%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3121

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2020-3121

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2020-3121

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sbsms-xss

Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-3121

Products affected by CVE-2020-3121

Exploit prediction scoring system (EPSS) score for CVE-2020-3121

CVSS scores for CVE-2020-3121

CWE ids for CVE-2020-3121

References for CVE-2020-3121