cnvd-2020-31961
Vulnerability from cnvd
Title
Cisco 809 Industrial ISRs、829 Industrial ISRs和Cisco 1000 Series Connected Grid Routers IOS Software命令注入漏洞
Description
Cisco IOS是美国思科（Cisco）公司的一套为其网络设备开发的操作系统。 Cisco 809 Industrial ISRs、829 Industrial ISRs和Cisco 1000 Series Connected Grid Routers (CGR1000) 中的IOS Software存在命令注入漏洞，该漏洞源于程序未能充分验证发送VDS相关CLI命令的参数。本地攻击者可利用该漏洞在VDS的Linux shell上下文中以root权限执行任意命令。
Severity
中
Patch Name
Cisco 809 Industrial ISRs、829 Industrial ISRs和Cisco 1000 Series Connected Grid Routers IOS Software命令注入漏洞的补丁
Patch Description
Cisco IOS是美国思科（Cisco）公司的一套为其网络设备开发的操作系统。 Cisco 809 Industrial ISRs、829 Industrial ISRs和Cisco 1000 Series Connected Grid Routers (CGR1000) 中的IOS Software存在命令注入漏洞，该漏洞源于程序未能充分验证发送VDS相关CLI命令的参数。本地攻击者可利用该漏洞在VDS的Linux shell上下文中以root权限执行任意命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE

Reference
https://nvd.nist.gov/vuln/detail/CVE-2020-3210
Impacted products
Name
['Cisco 809 Industrial Integrated Services Routers', 'Cisco 829 Industrial Integrated Services Routers', 'Cisco 1000 Series Connected Grid Routers']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-3210"
    }
  },
  "description": "Cisco IOS\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nCisco 809 Industrial ISRs\u3001829 Industrial ISRs\u548cCisco 1000 Series Connected Grid Routers (CGR1000) \u4e2d\u7684IOS Software\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u53d1\u9001VDS\u76f8\u5173CLI\u547d\u4ee4\u7684\u53c2\u6570\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728VDS\u7684Linux shell\u4e0a\u4e0b\u6587\u4e2d\u4ee5root\u6743\u9650\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-31961",
  "openTime": "2020-06-09",
  "patchDescription": "Cisco IOS\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nCisco 809 Industrial ISRs\u3001829 Industrial ISRs\u548cCisco 1000 Series Connected Grid Routers (CGR1000) \u4e2d\u7684IOS Software\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u53d1\u9001VDS\u76f8\u5173CLI\u547d\u4ee4\u7684\u53c2\u6570\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728VDS\u7684Linux shell\u4e0a\u4e0b\u6587\u4e2d\u4ee5root\u6743\u9650\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco 809 Industrial ISRs\u3001829 Industrial ISRs\u548cCisco 1000 Series Connected Grid Routers IOS Software\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco 809 Industrial Integrated Services Routers",
      "Cisco 829 Industrial Integrated Services Routers",
      "Cisco 1000 Series Connected Grid Routers"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-3210",
  "serverity": "\u4e2d",
  "submitTime": "2020-06-04",
  "title": "Cisco 809 Industrial ISRs\u3001829 Industrial ISRs\u548cCisco 1000 Series Connected Grid Routers IOS Software\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.