CVE-2020-3212

HIGH

Cisco IOS XE - Authenticated Remote Code Execution via Web UI File Upload

Title source: llm

Description

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by uploading a crafted file to the web UI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands with root privileges on the device.

References (1)

Core 1

Core References

Patch, Vendor Advisory vendor-advisory x_refsource_cisco

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj3-44st5CcA

Scores

CVSS v3 7.2

EPSS 0.0134

EPSS Percentile 80.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78 CWE-77

Status published

Products (6)

cisco/ios_xe 16.11.1

cisco/ios_xe 16.11.1a

cisco/ios_xe 16.11.1b

cisco/ios_xe 16.11.1c

cisco/ios_xe 16.11.1s

cisco/ios_xe 16.12.1y

Published Jun 03, 2020

Tracked Since Feb 18, 2026