TI-2020-02917 Aliases CVE-2020-3365 GHSA-3p39-2wh4-rwfp

Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

LOW 32CWE-22Published 2020-09-04 · Updated 2024-11-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directory permissions. An attacker could exploit this vulnerability by using capabilities that are not controlled by the role-based access control (RBAC) mechanisms of the software. A successful exploit could allow the attacker to overwrite files on an affected device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01625 76th percentileScored 2026-11-08

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco Enterprise NFV Infrastructure Software	all versions	—	No fix listed	CNA

Cisco Enterprise NFV Infrastructure Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software::::::::	3.5.1 – 4.1.2	Vulnerable	Cisco

cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:* Versions 3.5.1 – 4.1.2 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-3365
2026-10-03 Alias added: GHSA-3p39-2wh4-rwfp

References

Advisory 1

20200902 Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2021-13745 Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
TI-2020-03016 Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities CVSS 3.1CRITICAL 9.8
TI-2022-05339 Cisco Enterprise NFV Infrastructure Software Vulnerabilities CVSS 3.1CRITICAL 9.9
TI-2022-05338 Cisco Enterprise NFV Infrastructure Software Vulnerabilities CVSS 3.1CRITICAL 9.9
TI-2022-05336 Cisco Enterprise NFV Infrastructure Software Vulnerabilities CVSS 3.1CRITICAL 9.9

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences