RCE in Lenovo Cloud Networking Operating System
CVE-2020-8349
An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST API management interface. This interface is disabled by default and not vulnerable unless enabled. When enabled, it is only vulnerable where attached to a VRF and as allowed by defined ACLs. Lenovo strongly recommends upgrading to a non-vulnerable CNOS release. Where not possible, Lenovo recommends disabling the REST API management interface or restricting access to the management VRF and further limiting access to authorized management stations via ACL.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.022 (81.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Lenovo Cloud_networking_operating_system
- Lenovo Cloud Networking Operating System (Cnos) — versions unspecified
- Lenovo Rackswitch_g8272
- Lenovo Rackswitch_g8296
- Lenovo Rackswitch_g8332
- Lenovo Rackswitch_ne0152t
- Lenovo Rackswitch_ne10032
- Lenovo Rackswitch_ne1032
- Lenovo Rackswitch_ne1032t
- Lenovo Rackswitch_ne1072t
Weakness classification (CWE)
References
- psirt@lenovo.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-8349?
- CVE-2020-8349 is a critical-severity vulnerability in Lenovo Cloud Networking Operating System, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2020-10-14.
- How severe is CVE-2020-8349?
- Critical severity. CVSS v3 base score is 9.8 out of 10.