VULNERABILITY INTELLIGENCE

CVE-2020-3335

CVSS score5.5 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2020-06-03
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this vulnerability by logging in to an affected device locally with valid credentials. A successful exploit could allow the attacker to read the sensitive information of other users on the affected device.

Weakness classification

  • CWE-306: Missing Authentication for Critical Function
  • CWE-863: Incorrect Authorization

Primary references