{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:11:44Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-salt-2vx545AG","slug":"cisco-sa-salt-2vx545ag","vendor":"Cisco","title":"SaltStack FrameWork Vulnerabilities Affecting Cisco Products","summary":"On April 29, 2020, the Salt Open Core team notified their community regarding the following two CVE-IDs: CVE-2020-11651: Authentication Bypass Vulnerability CVE-2020-11652: Directory Traversal Vulnerability Cisco Modeling Labs Corporate Edition (CML), Cisco TelePresence IX5000 Series, and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE) incorporate a version of SaltStack that is running the salt-master service that is affected by these vulnerabilities. Cisco has released software updates that address these vulnerabilities. There are workarounds that address these vulnerabilities. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","severity":"Critical","published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG/csaf/cisco-sa-salt-2vx545AG.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":2,"visible_product_count":3,"public_evidence_count":6,"kev_count":2,"highest_epss":0.96405},"cves":[{"id":"CVE-2020-11651","kev":true,"kev_added_at":"2021-11-03","epss":{"score":0.96405,"percentile":0.99874,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"}},{"id":"CVE-2020-11652","kev":true,"kev_added_at":"2021-11-03","epss":{"score":0.86063,"percentile":0.99709,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"}}],"public_evidence":[{"product":{"name":"Cisco Modeling Labs","slug":"cisco-modeling-labs","vendor":"Cisco"},"cve":{"id":"CVE-2020-11651"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:09:52Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Modeling Labs","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.96405,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","advisory_updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG"},"row_display_order":1},{"product":{"name":"Cisco Virtual Internet Routing Lab","slug":"cisco-virtual-internet-routing-lab","vendor":"Cisco"},"cve":{"id":"CVE-2020-11651"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:09:52Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Virtual Internet Routing Lab","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.96405,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","advisory_updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG"},"row_display_order":2},{"product":{"name":"Cisco TelePresence IX5000","slug":"cisco-telepresence-ix5000","vendor":"Cisco"},"cve":{"id":"CVE-2020-11651"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:09:52Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco TelePresence IX5000","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.96405,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","advisory_updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG"},"row_display_order":3},{"product":{"name":"Cisco Modeling Labs","slug":"cisco-modeling-labs","vendor":"Cisco"},"cve":{"id":"CVE-2020-11652"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:09:52Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Modeling Labs","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.86063,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","advisory_updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG"},"row_display_order":4},{"product":{"name":"Cisco Virtual Internet Routing Lab","slug":"cisco-virtual-internet-routing-lab","vendor":"Cisco"},"cve":{"id":"CVE-2020-11652"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:09:52Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Virtual Internet Routing Lab","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.86063,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","advisory_updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG"},"row_display_order":5},{"product":{"name":"Cisco TelePresence IX5000","slug":"cisco-telepresence-ix5000","vendor":"Cisco"},"cve":{"id":"CVE-2020-11652"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:09:52Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco TelePresence IX5000","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.86063,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2020-05-28T16:00:00Z","updated_at":"2020-06-16T15:17:35Z","advisory_updated_at":"2020-06-16T15:17:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG"},"row_display_order":6}]}