CVE-2020-3234— Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-3234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the virtual console authentication of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated but low-privileged, local attacker to log in to the Virtual Device Server (VDS) of an affected device by using a set of default credentials. The vulnerability is due to the presence of weak, hard-coded credentials. An attacker could exploit this vulnerability by authenticating to the targeted device and then connecting to VDS through the device’s virtual console by using the static credentials. A successful exploit could allow the attacker to access the Linux shell of VDS as the root user.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco 809 Industrial ISRs、829 Industrial ISRs和Cisco CGR1000 IOS Software 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco 1000 Series Connected Grid Routers（CGR1000）是美国思科（Cisco）公司的一款1000系列互联网格路由器。 Cisco 809 Industrial ISRs、829 Industrial ISRs和Cisco CGR1000中的IOS Software的虚拟控制台身份验证存在信任管理问题漏洞，该漏洞源于程序使用了保密性较弱的硬编码凭证。本地攻击者可通过进行身份验证并借助静态凭证通过虚拟控制台连接到VDS利用该漏洞以root用户身份访问Linux sh
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco IOS 12.2(60)EZ16 | n/a | - |
II. Public POCs for CVE-2020-3234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-3234
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-3234 (1)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cred-uPMp9zbYvendor-advisoryx_refsource_CISCO
Same Patch Batch · Cisco · 2020-06-03 · 50 CVEs total
| CVE-2020-3353 | 5.9 MEDIUM | Cisco Identity Services Engine Denial of Service Vulnerability |
| CVE-2020-3319 | 3.3 LOW | Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerabilit |
| CVE-2020-3322 | 3.3 LOW | Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerabilit |
| CVE-2020-3321 | 3.3 LOW | Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerabilit |
| CVE-2020-3333 | Cisco Application Services Engine Software Unauthenticated Event Policies Update Vulnerabi | |
| CVE-2020-3257 | Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabil | |
| CVE-2020-3267 | Cisco Unified Contact Center Express Improper API Authorization Vulnerability | |
| CVE-2020-3258 | Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities | |
| CVE-2020-3281 | Cisco Digital Network Architecture Center Information Disclosure Vulnerability | |
| CVE-2020-3200 | Cisco IOS and IOS XE Software Secure Shell Denial of Service Vulnerability | |
| CVE-2020-3199 | Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabil | |
| CVE-2020-3198 | Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities | |
| CVE-2020-3228 | Cisco IOS, IOS XE, and NX-OS Software Security Group Tag Exchange Protocol Denial of Servi | |
| CVE-2020-3231 | Cisco IOS Software for Catalyst 2960-L Series Switches and Catalyst CDB-8P Switches 802.1X | |
| CVE-2020-3230 | Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabil | |
| CVE-2020-3229 | Cisco IOS XE Software Web UI Privilege Escalation Vulnerability | |
| CVE-2020-3227 | Cisco IOx for IOS XE Software Privilege Escalation Vulnerability | |
| CVE-2020-3226 | Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability | |
| CVE-2020-3224 | Cisco IOS XE Software Web UI Command Injection Vulnerability | |
| CVE-2020-3232 | Cisco ASR 920 Series Aggregation Services Router Model 12SZ-IM SNMP Denial of Service Vuln |
Showing top 20 of 50 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cisco IOS 12.2(60)EZ16
- CVE-2020-3258
Cisco IOS Software for Cisco Industrial Routers Arbitrary Co - CVE-2020-3257
Cisco IOx Application Environment for IOS Software for Cisco - CVE-2020-3199
Cisco IOx Application Environment for IOS Software for Cisco - CVE-2020-3198
Cisco IOS Software for Cisco Industrial Routers Arbitrary Co - CVE-2020-3210
Cisco IOS Software for Cisco Industrial Routers Virtual Devi
Same vendor: Cisco
- CVE-2026-20199
Cisco ThousandEyes Virtual Appliance 注入漏洞 - CVE-2026-20171
Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Den - CVE-2026-20206
Cisco ThousandEyes BrowserBot Command Injection Vulnerabilit - CVE-2026-20223
Cisco Secure Workload Unauthorized API Access Vulnerability - CVE-2026-20224
Cisco Catalyst SD-WAN Manager XML External Entity Injection
Same weakness: CWE-798
- CVE-2026-48245
Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in - CVE-2026-48244
Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in - CVE-2026-48243
Open ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in w - CVE-2026-48242
Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credenti - CVE-2026-48241
Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credenti
V. Comments for CVE-2020-3234
No comments yet