CVE-2020-3400

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue is related to insufficient authorization of web UI access requests in the web UI feature of Cisco IOS XE Software. This could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized, potentially enabling a Read-Only user to perform actions of an Admin user. The vulnerability can be exploited by sending a crafted HTTP request to the web UI.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.