Vulnerability Details : CVE-2020-3208

A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could allow an authenticated, local attacker to boot a malicious software image on an affected device. The vulnerability is due to insufficient access restrictions on the area of code that manages the image verification feature. An attacker could exploit this vulnerability by first authenticating to the targeted device and then logging in to the Virtual Device Server (VDS) of an affected device. The attacker could then, from the VDS shell, disable Cisco IOS Software integrity (image) verification. A successful exploit could allow the attacker to boot a malicious Cisco IOS Software image on the targeted device. To exploit this vulnerability, the attacker must have valid user credentials at privilege level 15.
Published 2020-06-03 18:15:19
Updated 2021-10-26 16:29:56
Source Cisco Systems, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-3208

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2020-3208

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
7.2
 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C
3.9
10.0
 NIST
6.7
 MEDIUM CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.8
5.9
 Cisco Systems, Inc.
6.7
 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.8
5.9
 NIST

CWE ids for CVE-2020-3208

  • Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2020-3208

Products affected by CVE-2020-3208

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close