Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (Cisco Cisco IOS XR Software)

CVE-2020-3364

MEDIUM 5.3

At a glance

Source: NVD
EPSS: EPSS 0.91 % · percentile 60 (2026-10-30)
State: PUBLISHED
Published: 2020-06-18 02:17 UTC
Updated: 2024-11-15 17:00 UTC
Assigner: cisco
NVD status: Modified

Search on…

Description

A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XR Software, which prevents the ACL from working when applied against the standby route processor management interface. An attacker could exploit this vulnerability by attempting to access the device through the standby route processor management interface.

Weaknesses (CWE)

CWE-284 — Improper Access Control
CWE-863 — Incorrect Authorization

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xracl-zbWSWREt

Scores

Version	Score	Vector	Scored by
CVSS 3.0	MEDIUM 5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	cisco
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.0	MEDIUM 5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	NVD · psirt@cisco.com (Secondary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2020-24635
GCVE · GCVE-0-2020-3364

Affected configurations (NVD CPE)

cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.0.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.0.11:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.0.12:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.1.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:7.1.15:*:*:*:*:*:*:*

Affected products

Product	Versions
Cisco · Cisco IOS XR Software	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability (Cisco Cisco IOS XR Software)