CVE-2020-3138

Katalog CVE

CVSS 6.7 · Medium EPSS 0,21%

Kerentanan Improper Verification of Cryptographic Signature pada cisco enterprise nfv infrastructure software. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to upload crafted code to the affected device.

Rincian

Terbit di NVD

19 Februari 2020

Terakhir diubah

24 Agustus 2026

Status NVD

Modified

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-codex-shs4NhvS advisory vendor