Vulnerability Description
A vulnerability in the secure boot process of Cisco FXOS Software could allow an authenticated, local attacker to bypass the secure boot mechanisms. The vulnerability is due to insufficient protections of the secure boot process. An attacker could exploit this vulnerability by injecting code into a specific file that is then referenced during the device boot process. A successful exploit could allow the attacker to break the chain of trust and inject code into the boot process of the device which would be executed at each boot and maintain persistence across reboots.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Firepower Extensible Operating System | < 2.4.1.268 |
| Cisco | Firepower 4110 | - |
| Cisco | Firepower 4112 | - |
| Cisco | Firepower 4115 | - |
| Cisco | Firepower 4120 | - |
| Cisco | Firepower 4125 | - |
| Cisco | Firepower 4140 | - |
| Cisco | Firepower 4145 | - |
| Cisco | Firepower 4150 | - |
| Cisco | Firepower 9300 Sm-24 | - |
| Cisco | Firepower 9300 Sm-36 | - |
| Cisco | Firepower 9300 Sm-40 | - |
| Cisco | Firepower 9300 Sm-44 | - |
| Cisco | Firepower 9300 Sm-44 X 3 | - |
| Cisco | Firepower 9300 Sm-48 | - |
| Cisco | Firepower 9300 Sm-56 | - |
| Cisco | Firepower 9300 Sm-56 X 3 | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fPatchVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fPatchVendor Advisory
FAQ
What is CVE-2020-3455?
CVE-2020-3455 is a vulnerability with a CVSS score of 7.8 (HIGH). A vulnerability in the secure boot process of Cisco FXOS Software could allow an authenticated, local attacker to bypass the secure boot mechanisms. The vulnerability is due to insufficient protection...
How severe is CVE-2020-3455?
CVE-2020-3455 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-3455?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Firepower Extensible Operating System, Cisco Firepower 4110, Cisco Firepower 4112, Cisco Firepower 4115, Cisco Firepower 4120.