What is CVE-2020-3209?

CVE-2020-3209 is a medium-severity vulnerability in Cisco Ios Xe Software 3.2.0sg, classified under Improper Verification of Cryptographic Signature. CVSS score: 6.8/10. Published 2020-06-03.

How severe is CVE-2020-3209?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Cisco Ios Xe Software 3.2.0sg

CVE-2020-3209

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to install and boot a malicious software image or execute unsigned binaries on the targeted device.

EPSS: 0.003 (18.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Ios Xe Software 3.2.0sg — versions n/a
Cisco Ios_xe — versions 3.2.0se, 3.2.0sg, 3.2.1se

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2020-3209?: CVE-2020-3209 is a medium-severity vulnerability in Cisco Ios Xe Software 3.2.0sg, classified under Improper Verification of Cryptographic Signature. CVSS score: 6.8/10. Published 2020-06-03.
How severe is CVE-2020-3209?: Medium severity. CVSS v3 base score is 6.8 out of 10.