A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (OS) of an affected device. The vulnerability is due to insufficient restrictions on Lua function calls within the context of user-supplied Lua scripts. An attacker with valid administrative credentials could exploit this vulnerability by submitting a malicious Lua script. When this file is processed, an exploitable buffer overflow condition could occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux OS of the affected device.
References
| Link | Resource |
|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lua-rce-7VeJX4f | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
22 May 2023, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:cisco:isr_1101:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1120:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1111x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1160:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_111x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1109:-:*:*:*:*:*:*:* |
cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:* |
07 Oct 2021, 20:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:cisco:isr_1100_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1009-x_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1101_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_111x_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1109_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1006-x_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1111x_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1120_router:-:*:*:*:*:*:*:* |
cpe:2.3:h:cisco:isr_1111x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1100:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1101:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_111x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1160:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1120:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:isr_1109:-:*:*:*:*:*:*:* |
05 Oct 2021, 14:51
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:cisco:asr_1002-x_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1001-x_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1004_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1002-hx_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1001-hx_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1013_router:-:*:*:*:*:*:*:* |
cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:* |
Information
Published : 2020-09-24 18:15
Updated : 2024-02-04 21:23
NVD link : CVE-2020-3423
Mitre link : CVE-2020-3423
CVE.ORG link : CVE-2020-3423
JSON object : View
Products Affected
cisco
- 4351_integrated_services_router
- 4461_integrated_services_router
- asr_1013
- asr_1004
- cloud_services_router_1000v
- 4331_integrated_services_router
- 4431_integrated_services_router
- cbr-8_converged_broadband_router
- asr_1006-x
- asr_1002-x
- 1109_integrated_services_router
- 1101_integrated_services_router
- asr_1001-x
- 1100_integrated_services_router
- asr_1002-hx
- 1160_integrated_services_router
- ios_xe
- asr_1006
- 4221_integrated_services_router
- 4321_integrated_services_router
- asr_1001-hx
- 4451-x_integrated_services_router
- 1120_integrated_services_router
- 111x_integrated_services_router
- asr_1009-x
- 1111x_integrated_services_router
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer