60
CVE-2020-3138
—CVSS 3.1
6.7 medium
EPSS
<1%p11
Published
()
Modified
Description
A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to upload crafted code to the affected device.
- Vendors
- cisco
- Products
- enterprise nfv infrastructure software
- Weakness
- CWE-347
- Vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H