What’s Vulnerable › Vulnerabilities
CVE-2020-3297: Cisco Small Business Smart and Managed Switches Session Management Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-07-02 · updated 2026-06-17
- Weakness: CWE-287
Description
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device. The vulnerability is due to the use of weak entropy generation for session identifier values. An attacker could exploit this vulnerability to determine a current session identifier through brute force and reuse that session identifier to take over an ongoing session. In this way, an attacker could take actions within the management interface with privileges up to the level of the administrative user.
Affected products
- Cisco Sf200-24 Firmware: all versions
- Cisco Sf200-24Fp Firmware: all versions
- Cisco Sf200-24P Firmware: all versions
- Cisco Sf200-48 Firmware: all versions
- Cisco Sf200-48P Firmware: all versions
- Cisco Sf200E-24 Firmware: all versions
- Cisco Sf200E-24P Firmware: all versions
- Cisco Sf200E-48 Firmware: all versions
- Cisco Sf200E-48P Firmware: all versions
- Cisco Sf250-24 Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf250-24P Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf250-48 Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf250-48Hp Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf300-08 Firmware: all versions
- Cisco Sf300-24 Firmware: all versions
- Cisco Sf300-24Mp Firmware: all versions
- Cisco Sf300-24P Firmware: all versions
- Cisco Sf300-24Pp Firmware: all versions
- Cisco Sf300-48 Firmware: all versions
- Cisco Sf300-48P Firmware: all versions
- Cisco Sf300-48Pp Firmware: all versions
- Cisco Sf302-08 Firmware: all versions
- Cisco Sf302-08Mp Firmware: all versions
- Cisco Sf302-08Mpp Firmware: all versions
- Cisco Sf302-08P Firmware: all versions
- Cisco Sf302-08Pp Firmware: all versions
- Cisco Sf350-48 Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf350-48Mp Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf350-48P Firmware: before 2.5.5.47 — fixed in 2.5.5.47
- Cisco Sf500-24 Firmware: all versions
How to fix
Upgrade to a fixed version: Cisco Sf250-24 Firmware 2.5.5.47; Cisco Sf250-24P Firmware 2.5.5.47; Cisco Sf250-48 Firmware 2.5.5.47; Cisco Sf250-48Hp Firmware 2.5.5.47; Cisco Sf350-48 Firmware 2.5.5.47; Cisco Sf350-48Mp Firmware 2.5.5.47; Cisco Sf350-48P Firmware 2.5.5.47; Cisco Sf550X-24 Firmware 2.5.5.47; Cisco Sf550X-24Mp Firmware 2.5.5.47; Cisco Sf550X-24P Firmware 2.5.5.47; Cisco Sf550X-48 Firmware 2.5.5.47; Cisco Sf550X-48Mp Firmware 2.5.5.47. Check the vendor advisory for mitigations.
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbswitch-session-JZAS5jnY
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbswitch-session-JZAS5jnY
Get alerted when CVE-2020-3297 or the next vulnerability affects your stack