Vulnslist

find the latest Cisco vulnerabilities

Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

cisco-sa-xracl-zbWSWREt · Medium · Published · Updated

A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XR Software, which prevents the ACL from working when applied against the standby route processor management interface. An attacker could exploit this vulnerability by attempting to access the device through the standby route processor management interface. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xracl-zbWSWREt

Workarounds

There are no workarounds that address this vulnerability.

However, administrators can choose one of the following mitigation options to help decrease any attack surface:

For features that leverage the TTYs, apply an ACL to all VTY lines. This will mitigate this vulnerability for those applications, as shown in the following example:

line template vty
access-class ingress MGMT_ACL_V4
!
vty-pool default 0 9 line-template vty

For features that leverage a feature-specific ACL, apply an ACL to the feature itself. This will mitigate this vulnerability for those applications as shown in the following examples:

NETCONF

ssh server netconf ipv4 access-list MGMT_ACL_V4

SSH

ssh server ipv4 access-list MGMT_ACL_V4

Telnet

telnet ipv4 server max-servers 3 access-list MGMT_ACL_V4

For features that are controlled through management plane protection, apply an out-of-band management plane protection policy, as shown in the following example:

control-plane
management-plane
out-of-band
interface MgmtEth0/RSP0/CPU0/0
allow all peer
address ipv4 192.168.1.1
!
!
interface MgmtEth0/RSP1/CPU0/0
allow all peer
address ipv4 192.168.1.1
!
!

Note: Applications that are accessible on the device that do not require a TTY to be allocated and do not support application-specific ACLs are still exposed.

CVEsCVE-2020-3364
Cisco Bug IDsCSCvt55079
CVSS ScoreBase 5.3
Base 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:X
Product Names From Source
Cisco IOS XR Software

CSAF Product Statuses

Product Status Source CVE Rows
Cisco IOS XR Software known_affected cisco_csaf CVE-2020-3364 1

Related Products

Product CVE Evidence
Cisco IOS XR Software CVE-2020-3364 Cisco OpenVuln
Cisco IOS CVE-2020-3364 Cisco OpenVuln
Cisco IOS Software CVE-2020-3364 Cisco OpenVuln