CVE-2020-3417

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to execute persistent code at boot time and break the chain of trust. This vulnerability is due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit this vulnerability by installing code to a specific directory in the underlying operating system (OS) and setting a specific ROMMON variable. A successful exploit could allow the attacker to execute persistent code on the underlying OS. To exploit this vulnerability, the attacker would need access to the root shell on the device or have physical access to the device.

• CWE-78
• CWE-78

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xbace-OnCEbySVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xbace-OnCEbySVendor Advisory

Published

Sep 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3411A vulnerability in Cisco DNA Center software could allow an …7.5
• CVE-2020-3412A vulnerability in the scheduled meeting template feature of…4.3
• CVE-2020-3413A vulnerability in the scheduled meeting template feature of…4.3
• CVE-2020-3414A vulnerability in the packet processing of Cisco IOS XE Sof…8.6
• CVE-2020-3415A vulnerability in the Data Management Engine (DME) of Cisco…8.8
• CVE-2020-3416Multiple vulnerabilities in the initialization routines that…6.7
• CVE-2020-3418A vulnerability in Cisco IOS XE Wireless Controller Software…4.7
• CVE-2020-3419A vulnerability in Cisco Webex Meetings and Cisco Webex Meet…9.1
• CVE-2020-3420A vulnerability in the web-based management interface of Cis…5.4
• CVE-2020-3421Multiple vulnerabilities in the Zone-Based Firewall feature …7.5
• CVE-2020-3422A vulnerability in the IP Service Level Agreement (SLA) resp…7.5
• CVE-2020-3423A vulnerability in the implementation of the Lua interpreter…6.7