CVE-2020-3367 is a command injection vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance. An authenticated, local attacker can exploit insufficient input validation in the web interface or CLI to inject scripting commands. This allows for arbitrary command execution on the underlying operating system and privilege escalation to root. The vulnerability has a CVSS score of 7.8 (High), indicating a low attack complexity and requiring low privileges, with high impact on confidentiality, integrity, and availability. There is no public exploit code available (Metasploit, Nuclei, ExploitDB), it is not listed in the KEV catalog, and community discussion and media coverage are minimal, suggesting it is not actively exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 11.7.2-011CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* | ||
>= 11.8.0, < 11.8.2-009CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* | ||
>= 12.0.0, < 12.0.2CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* | ||
>= 12.5.0, < 12.5.1-011CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.