CVE-2020-3416

CVE-2020-3416 describes multiple vulnerabilities in Cisco IOS XE Software for ASR 900 Series Aggregation Services Routers with an RSP3, allowing an authenticated, local attacker with high privileges to execute persistent code at bootup and compromise the chain of trust. The vulnerabilities stem from incorrect boot script validations when specific ROM monitor variables are set. A successful exploit could grant root privileges on the underlying operating system. The vulnerability has a CVSS score of 6.7 (MEDIUM), indicating a local attack vector with low complexity, requiring high privileges, and leading to high impact on confidentiality, integrity, and availability. Exploitation necessitates either root shell access or physical access to the device. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or attention.