What is CVE-2020-3524?

CVE-2020-3524 is a medium-severity vulnerability in Cisco 4221_integrated_services_router, classified under Improper Access Control. CVSS score: 6.8/10. Published 2020-09-24.

How severe is CVE-2020-3524?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Auth bypass in Cisco 4221_integrated_services_router

CVE-2020-3524

A vulnerability in the Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services Routers, Cisco ASR 1000 Series Aggregation Services Routers, and Cisco cBR-8 Con…

EPSS: 0.003 (19.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco 4221_integrated_services_router
Cisco 4331_integrated_services_router
Cisco 4431_integrated_services_router
Cisco 4461_integrated_services_router
Cisco Asr_1000-x
Cisco Asr_1001
Cisco Asr_1001-x
Cisco Asr_1002
Cisco Asr_1002-x
Cisco Asr_1004

Weakness classification (CWE)

CWE-284 — Improper Access Control
CWE-862 — Missing Authorization

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2020-3524?: CVE-2020-3524 is a medium-severity vulnerability in Cisco 4221_integrated_services_router, classified under Improper Access Control. CVSS score: 6.8/10. Published 2020-09-24.
How severe is CVE-2020-3524?: Medium severity. CVSS v3 base score is 6.8 out of 10.