A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (OS) of an affected device. The vulnerability is due to insufficient restrictions on Lua function calls within the context of user-supplied Lua scripts. An attacker with valid administrative credentials could exploit this vulnerability by submitting a malicious Lua script. When this file is processed, an exploitable buffer overflow condition could occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux OS of the affected device.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 05:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lua-rce-7VeJX4f - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 5.1 |
22 May 2023, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:cisco:isr_1120:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1100:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1111x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1109:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1160:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_111x:-:*:*:*:*:*:*:* |
cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:* |
| First Time |
Cisco 1111x Integrated Services Router
Cisco 1109 Integrated Services Router Cisco 1160 Integrated Services Router Cisco 1120 Integrated Services Router Cisco 1101 Integrated Services Router Cisco 111x Integrated Services Router |
Information
Published : 2020-09-24 18:15
Updated : 2024-11-21 05:31
NVD link : CVE-2020-3423
Mitre link : CVE-2020-3423
CVE.ORG link : CVE-2020-3423
JSON object : View
Products Affected
cisco
- 4221_integrated_services_router
- 1160_integrated_services_router
- 1101_integrated_services_router
- 4451-x_integrated_services_router
- asr_1006-x
- asr_1009-x
- 4351_integrated_services_router
- 1100_integrated_services_router
- asr_1001-hx
- ios_xe
- cloud_services_router_1000v
- asr_1002-x
- asr_1004
- asr_1001-x
- 1109_integrated_services_router
- 4321_integrated_services_router
- asr_1002-hx
- asr_1006
- cbr-8_converged_broadband_router
- 4461_integrated_services_router
- 4331_integrated_services_router
- asr_1013
- 111x_integrated_services_router
- 1111x_integrated_services_router
- 4431_integrated_services_router
- 1120_integrated_services_router
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer