CVE-2020-3423 : A vulnerability in the implementation of the Lua interpreter that is integrated

A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (OS) of an affected device. The vulnerability is due to insufficient restrictions on Lua function calls within the context of user-supplied Lua scripts. An attacker with valid administrative credentials could exploit this vulnerability by submitting a malicious Lua script. When this file is processed, an exploitable buffer overflow condition could occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux OS of the affected device.

Published 2020-09-24 18:15:19

Updated 2023-05-22 18:57:25

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2020-3423

Cisco » Ios Xe » Version: N/A
cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 1100 Integrated Services Router » Version: N/A
When used together with: Cisco » 1101 Integrated Services Router » Version: N/A
When used together with: Cisco » 1109 Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x Integrated Services Router » Version: N/A
When used together with: Cisco » 111x Integrated Services Router » Version: N/A
When used together with: Cisco » 1120 Integrated Services Router » Version: N/A
When used together with: Cisco » 1160 Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4451-x Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » Asr 1001-hx » Version: N/A
When used together with: Cisco » Asr 1001-x » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1002-x » Version: N/A
When used together with: Cisco » Asr 1004 » Version: N/A
When used together with: Cisco » Asr 1006 » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Asr 1013 » Version: N/A
When used together with: Cisco » Cbr-8 Converged Broadband Router » Version: N/A
When used together with: Cisco » Cloud Services Router 1000v » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-3423

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3423

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
5.1	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N	0.8	4.2	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: High Availability: None
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-3423

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2020-3423

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lua-rce-7VeJX4f

Cisco IOS XE Software Arbitrary Code Execution Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-3423

Products affected by CVE-2020-3423

Exploit prediction scoring system (EPSS) score for CVE-2020-3423

CVSS scores for CVE-2020-3423

CWE ids for CVE-2020-3423

References for CVE-2020-3423