1. Home
  2. CVE Database
  3. CVE-2020-3297
CRITICAL · 9.8

CVE-2020-3297

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protection...

Vulnerability Description

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device. The vulnerability is due to the use of weak entropy generation for session identifier values. An attacker could exploit this vulnerability to determine a current session identifier through brute force and reuse that session identifier to take over an ongoing session. In this way, an attacker could take actions within the management interface with privileges up to the level of the administrative user.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CiscoSg250X-24 Firmware< 2.5.5.47
CiscoSg250X-24-
CiscoSg250X-24P Firmware< 2.5.5.47
CiscoSg250X-24P-
CiscoSg250X-48 Firmware< 2.5.5.47
CiscoSg250X-48-
CiscoSg250X-48P Firmware< 2.5.5.47
CiscoSg250X-48P-
CiscoSg250-08 Firmware< 2.5.5.47
CiscoSg250-08-
CiscoSg250-08Hp Firmware< 2.5.5.47
CiscoSg250-08Hp-
CiscoSg250-10P Firmware< 2.5.5.47
CiscoSg250-10P-
CiscoSg250-18 Firmware< 2.5.5.47
CiscoSg250-18-
CiscoSg250-26 Firmware< 2.5.5.47
CiscoSg250-26-
CiscoSg250-26Hp Firmware< 2.5.5.47
CiscoSg250-26Hp-

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2020-3297?

CVE-2020-3297 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protection...

How severe is CVE-2020-3297?

CVE-2020-3297 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-3297?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Sg250X-24 Firmware, Cisco Sg250X-24, Cisco Sg250X-24P Firmware, Cisco Sg250X-24P, Cisco Sg250X-48 Firmware.