« Volver al listado

CVE-2020-8349

Estado: ModificadaCrítica (9.8)—

An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST API management interface. This interface is disabled by default and not vulnerable unless enabled. When enabled, it is only vulnerable where attached to a VRF and as allowed by defined ACLs. Lenovo strongly recommends upgrading to a non-vulnerable CNOS release. Where not possible, Lenovo recommends disabling the REST API management interface or restricting access to the management VRF and further limiting access to authorized management stations via ACL.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lenovo — Cloud Networking Operating System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8349",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@lenovo.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@lenovo.com",
      "affectedData": [
        {
          "vendor": "Lenovo",
          "product": "Cloud Networking Operating System (CNOS)",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "10.10.6.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-14T22:15:13.653",
  "references": [
    {
      "url": "https://support.lenovo.com/us/en/product_security/LEN-44423",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@lenovo.com"
    },
    {
      "url": "https://support.lenovo.com/us/en/product_security/LEN-44423",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@lenovo.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST API management interface. This interface is disabled by default and not vulnerable unless enabled. When enabled, it is only vulnerable where attached to a VRF and as allowed by defined ACLs. Lenovo strongly recommends upgrading to a non-vulnerable CNOS release. Where not possible, Lenovo recommends disabling the REST API management interface or restricting access to the management VRF and further limiting access to authorized management stations via ACL."
    },
    {
      "lang": "es",
      "value": "Una revisión de seguridad interna identificó una vulnerabilidad de ejecución de código remota no autenticada en la interfaz de administración de la API REST opcional de Cloud Networking Operating System (CNOS)’. Esta interfaz está deshabilitada por defecto y no es vulnerable a menos que esté habilitada. Cuando está habilitada, solo es vulnerable cuando está conectado a un VRF y según lo permitan las ACL definidas. Lenovo recomienda encarecidamente actualizar a una versión CNOS no vulnerable. Cuando no sea posible, Lenovo recomienda deshabilitar la interfaz de administración de la API REST o restringir el acceso al VRF de administración y limitar aún más el acceso a las estaciones de administración autorizadas mediante ACL"
    }
  ],
  "lastModified": "2026-06-17T03:26:18.873",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:cloud_networking_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "144A51B2-76BD-432F-B88A-65319FAEFFD0",
              "versionEndExcluding": "10.10.6.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_g8272:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DB8AF1A2-AC14-46E3-BCF1-41C48F0D45BA"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_g8296:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B3C14274-E752-4FCF-96DE-8EE02D07BB48"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_g8332:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B8D47782-1C9C-4C89-852C-637E09CB9E20"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_ne0152t:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D78FFD69-80A3-4D6B-AEC2-FFA6192454D0"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_ne10032:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EF898320-239A-42C1-BB49-75402894064B"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_ne1032:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8CB91FF4-B209-4810-95EB-0112963247ED"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_ne1032t:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C1C531F7-AEA1-4AAE-AD7D-7416EE85E1F5"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_ne1072t:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A5BA1E79-AA8B-4CDB-872C-21B16FB65124"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:rackswitch_ne2572:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0B5A57CB-32B7-4658-8B35-E54DBFAABC24"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@lenovo.com"
}