What is the CVSS score of CVE-2020-3121?

CVE-2020-3121 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 1.1%.

Sg250X 24 Firmware CVE-2020-3121

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2020-01-26 psirt@cisco.com

XSS Cisco Sg250X 24 Firmware Sg250X 24P Firmware Sg250X 48 Firmware Sg250X 48P Firmware Sg250 08 Firmware Sg250 08Hp Firmware Sg250 10P Firmware Sg250 18 Firmware Sg250 26 Firmware Sg250 26Hp Firmware Sg250 26P Firmware Sg250 50 Firmware Sg250 50Hp Firmware Sg250 50P Firmware Sg250 24 Firmware Sg250 24P Firmware Sg250 48 Firmware Sg250 48Hp Firmware Sf350 48 Firmware Sf350 48P Firmware Sf350 48Mp Firmware Sg350 10 Firmware Sg350 10P Firmware Sg350 10Mp Firmware Sg355 10Mp Firmware Sg350 28 Firmware Sg350 28P Firmware Sg350 28Mp Firmware Sx550X 16Ft Firmware Sx550X 24Ft Firmware Sx550X 12Ft Firmware Sx550X 24 Firmware Sx550X 52 Firmware Sg550X 24 Firmware Sg550X 24P Firmware Sg550X 24Mp Firmware Sg550X 24Mpp Firmware Sg550X 48 Firmware Sg550X 48P Firmware Sg550X 48Mp Firmware Sf550X 24 Firmware Sf550X 24P Firmware Sf550X 48 Firmware Sf550X 48P Firmware Sf550X 48Mp Firmware

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Jan 26, 2020 - 05:15 nvd

MEDIUM 6.1

DescriptionNVD

A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and access a specific page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

AnalysisAI

A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and access a specific page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Affected products include: Cisco Sg250X-24 Firmware, Cisco Sg250X-24P Firmware, Cisco Sg250X-48 Firmware, Cisco Sg250X-48P Firmware, Cisco Sg250-08 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.