CVE-2020-3215: Cisco IOS XE

Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an affected device. The vulnerability is due to insufficient validation of a user-supplied open virtual appliance (OVA). An attacker could exploit this vulnerability by installing a malicious OVA on an affected device.

Affected products

• Cisco IOS XE: version 3.7.0e only; version 3.7.1e only; version 3.7.2e only; version 3.7.3e only; version 3.7.4e only; version 3.7.5e only; …

Published 2020-06-03. Last modified 2026-06-17.