CVE-2020-3477

Cisco IOS and IOS XE Software Information Disclosure Vulnerability

MEDIUM

5.5

CVSS Score

Published: September 24, 2020 at 05:52 PM UTC

Updated: June 17, 2026 at 03:18 AM UTC

9 products affected across 1 vendorIOS2611Xm2651Xm

Using Cisco IOS by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by using a specific command at the command line. A successful exploit could allow the attacker to obtain read-only access to files that are located on the flash: filesystem that otherwise might not have been accessible.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS · Cisconpm

95%

16.3.11

cisco-2610xm (environment) · cisco-2611xm (environment) · cisco-2612 (environment) · cisco-2620xm (environment) · cisco-2621xm (environment) · cisco-2650xm (environment) · cisco-2651xm (environment) · cisco-2691 (environment)

2610Xm · Ciscodevice

80%

All versions

2611Xm · Ciscodevice

80%

All versions

2612 · Ciscodevice

80%

All versions

2620Xm · Ciscodevice

80%

All versions