{"containers": {"cna": {"affected": [{"product": "Cisco Firepower Extensible Operating System (FXOS) ", "vendor": "Cisco", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2020-09-02T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that, when it is processed, may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability."}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-119", "description": "CWE-119", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-09-04T02:25:22", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20200902 Cisco FXOS Software Buffer Overflow Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-buffer-cSdmfWUt"}], "source": {"advisory": "cisco-sa-fxos-buffer-cSdmfWUt", "defect": [["CSCvd72523"]], "discovery": "INTERNAL"}, "title": "Cisco FXOS Software Buffer Overflow Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2020-09-02T16:00:00", "ID": "CVE-2020-3545", "STATE": "PUBLIC", "TITLE": "Cisco FXOS Software Buffer Overflow Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco Firepower Extensible Operating System (FXOS) ", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "Cisco"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that, when it is processed, may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability."}]}, "exploit": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}], "impact": {"cvss": {"baseScore": "6.0", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N ", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-119"}]}]}, "references": {"reference_data": [{"name": "20200902 Cisco FXOS Software Buffer Overflow Vulnerability", "refsource": "CISCO", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-buffer-cSdmfWUt"}]}, "source": {"advisory": "cisco-sa-fxos-buffer-cSdmfWUt", "defect": [["CSCvd72523"]], "discovery": "INTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2020-3545", "datePublished": "2020-09-02T00:00:00", "dateReserved": "2019-12-12T00:00:00", "dateUpdated": "2020-09-04T02:25:22", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8AE065A-F2A7-43E0-97ED-75232A9D2E2A", "versionEndIncluding": "2.3.1.58", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*", "matchCriteriaId": "A0CBC7F5-7767-43B6-9384-BE143FCDBD7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*", "matchCriteriaId": "957D64EB-D60E-4775-B9A8-B21CA48ED3B1", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*", "matchCriteriaId": "A694AD51-9008-4AE6-8240-98B17AB527EE", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*", "matchCriteriaId": "38AE6DC0-2B03-4D36-9856-42530312CC46", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*", "matchCriteriaId": "71DCEF22-ED20-4330-8502-EC2DD4C9838F", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*", "matchCriteriaId": "3DB2822B-B752-4CD9-A178-934957E306B4", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*", "matchCriteriaId": "81F4868A-6D62-479C-9C19-F9AABDBB6B24", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*", "matchCriteriaId": "65378F3A-777C-4AE2-87FB-1E7402F9EA1B", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*", "matchCriteriaId": "07DAFDDA-718B-4B69-A524-B0CEB80FE960", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that, when it is processed, may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco FXOS Software podr\u00eda permitir a un atacante local autenticado con credenciales administrativas causar una condici\u00f3n de desbordamiento del b\u00fafer. La vulnerabilidad es debido a una comprobaci\u00f3n incorrecta de l\u00edmites de los valores que son analizados desde un archivo espec\u00edfico. Un atacante podr\u00eda explotar esta vulnerabilidad al suministrar un archivo dise\u00f1ado que, cuando es procesado, puede causar un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario en el sistema operativo subyacente con privilegios root. Un atacante necesitar\u00eda tener credenciales administrativas v\u00e1lidas para explotar esta vulnerabilidad"}], "id": "CVE-2020-3545", "lastModified": "2023-11-07T03:22:53.650", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2020-09-04T03:15:11.043", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-buffer-cSdmfWUt"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-119"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}