TI-2020-03142 Aliases CVE-2020-3602 GHSA-5c39-v7fv-jprr

Cisco StarOS Privilege Escalation Vulnerability

LOW 30CWE-20Published 2020-10-08 · Updated 2024-11-13

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. The vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user on the affected device. To exploit this vulnerability, an attacker would need to have valid credentials on an affected device and know the password for the cli test-commands command.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00387 33rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco ASR 5000 Series Software	all versions	—	No fix listed	CNA

Cisco ASR 5000 Series Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:staros::::::::	before 21.19.n4	Vulnerable	Cisco
cpe:2.3:h:cisco:asr_5500:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:h:cisco:asr_5700:-:::::::*	not specified by NVD	Running on	Cisco

cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:* Versions before 21.19.n4 Vulnerable ·Cisco
cpe:2.3:h:cisco:asr_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:h:cisco:asr_5700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-3602
2026-10-03 Alias added: GHSA-5c39-v7fv-jprr

References

Advisory 1

20201007 Cisco StarOS Privilege Escalation Vulnerability

TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2019-01491 Cisco StarOS Denial of Service Vulnerability CVSS 3.0HIGH 8.6
TI-2018-00328 Improper input validation in Cisco StarOS unknown CVSS 3.0HIGH 8.6
TI-2021-01080 Cisco StarOS IPv4 Denial of Service Vulnerability CVSS 3.1HIGH 8.6
TI-2018-00201 Improper input validation in Cisco StarOS CVSS 3.1HIGH 7.5
TI-2021-01105 Cisco StarOS Denial of Service Vulnerability CVSS 3.1HIGH 7.5

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences