A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.
Metrics
Affected Vendors & Products
References
History
Wed, 13 Nov 2024 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2020-09-24T18:02:27.374901Z
Updated: 2024-11-13T17:54:22.654Z
Reserved: 2019-12-12T00:00:00
Link: CVE-2020-3396
Vulnrichment
Updated: 2024-08-04T07:30:58.382Z
NVD
Status : Modified
Published: 2020-09-24T18:15:17.683
Modified: 2024-11-21T05:30:56.857
Link: CVE-2020-3396
Redhat
No data.