What is CVE-2020-3394?

CVE-2020-3394 is a high-severity vulnerability in Cisco Nx-os Software, classified under Improper Authorization. CVSS score: 7.8/10. Published 2020-08-27.

How severe is CVE-2020-3394?

High severity. CVSS v3 base score is 7.8 out of 10.

Auth bypass in Cisco Nx-os Software

CVE-2020-3394

A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administra…

EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Nx-os Software — versions n/a
Cisco Nexus_3016
Cisco Nexus_3048
Cisco Nexus_3064
Cisco Nexus_3064-t
Cisco Nexus_31108pc-v
Cisco Nexus_31108tc-v
Cisco Nexus_31128pq
Cisco Nexus_3132c-z
Cisco Nexus_3132q

Weakness classification (CWE)

CWE-285 — Improper Authorization
CWE-862 — Missing Authorization

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2020-3394?: CVE-2020-3394 is a high-severity vulnerability in Cisco Nx-os Software, classified under Improper Authorization. CVSS score: 7.8/10. Published 2020-08-27.
How severe is CVE-2020-3394?: High severity. CVSS v3 base score is 7.8 out of 10.