CVE-2026-20046

{"id": "CVE-2026-20046", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20046", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "7.9.1"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.10.1"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.9.2"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.11.1"}, {"status": "affected", "version": "7.10.2"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "24.1.1"}, {"status": "affected", "version": "7.11.2"}, {"status": "affected", "version": "24.2.1"}, {"status": "affected", "version": "24.1.2"}, {"status": "affected", "version": "24.3.1"}, {"status": "affected", "version": "24.4.1"}, {"status": "affected", "version": "24.2.2"}, {"status": "affected", "version": "7.11.21"}, {"status": "affected", "version": "24.2.20"}, {"status": "affected", "version": "24.3.2"}, {"status": "affected", "version": "24.4.2"}, {"status": "affected", "version": "25.1.1"}, {"status": "affected", "version": "24.3.20"}, {"status": "affected", "version": "25.2.1"}, {"status": "affected", "version": "25.1.2"}, {"status": "affected", "version": "24.3.30"}, {"status": "affected", "version": "24.2.21"}, {"status": "affected", "version": "25.1.30"}], "defaultStatus": "unknown"}]}], "published": "2026-03-11T17:16:55.230", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privesc-bF8D5U4W", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device.\r\n\r\nThis vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks."}, {"lang": "es", "value": "Una vulnerabilidad en la asignaci\u00f3n de grupos de tareas para un comando CLI espec\u00edfico en el software Cisco IOS XR podr\u00eda permitir a un atacante local autenticado elevar privilegios y obtener control administrativo total de un dispositivo afectado.\n\nEsta vulnerabilidad se debe a un mapeo incorrecto de un comando a grupos de tareas dentro del c\u00f3digo fuente. Un atacante con una cuenta de bajos privilegios podr\u00eda explotar esta vulnerabilidad usando el comando CLI para eludir las comprobaciones basadas en grupos de tareas. Un exploit exitoso podr\u00eda permitir al atacante elevar privilegios y realizar acciones en un dispositivo afectado sin comprobaciones de autorizaci\u00f3n."}], "lastModified": "2026-07-01T17:10:13.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5A5E154-0631-4AEC-8675-7257BABF5086", "versionEndExcluding": "25.2.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ios_xrv_9000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EEE98C3E-67E2-43A3-AEA9-1575F2B93A78"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@cisco.com"}