CVE-2020-3216
Last modified
CVE-2020-3216 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by stopping the boot initialization of an affected device. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device.
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe Sd-Wan | 16.9.0 |
| Cisco | Ios Xe Sd-Wan | 16.9.1 |
| Cisco | Ios Xe Sd-Wan | 16.9.2 |
| Cisco | Ios Xe Sd-Wan | 16.9.3 |
| Cisco | Ios Xe Sd-Wan | 16.9.4 |
| Cisco | Ios Xe Sd-Wan | 16.10.0 |
| Cisco | Ios Xe Sd-Wan | 16.10.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-3216?
How severe is CVE-2020-3216?
How do I fix CVE-2020-3216?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-3210A vulnerability in the CLI parsers of Cisco IOS Software for…6.7
- CVE-2020-3211A vulnerability in the web UI of Cisco IOS XE Software could…7.2
- CVE-2020-3212A vulnerability in the web UI of Cisco IOS XE Software could…7.2
- CVE-2020-3213A vulnerability in the ROMMON of Cisco IOS XE Software could…6.7
- CVE-2020-3214A vulnerability in Cisco IOS XE Software could allow an auth…6.7
- CVE-2020-3215A vulnerability in the Virtual Services Container of Cisco I…6.7
- CVE-2020-3217A vulnerability in the Topology Discovery Service of Cisco O…8.8
- CVE-2020-3218A vulnerability in the web UI of Cisco IOS XE Software could…7.2
- CVE-2020-3219A vulnerability in the web UI of Cisco IOS XE Software could…8.8
- CVE-2020-3220A vulnerability in the hardware crypto driver of Cisco IOS X…6.8
- CVE-2020-3221A vulnerability in the Flexible NetFlow Version 9 packet pro…8.6
- CVE-2020-3222A vulnerability in the web-based user interface (web UI) of …4.3
Are you affected by CVE-2020-3216?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST