dbcve.org
Cloud Networking Operating SystemOperating system · Lenovo

CVE-2020-8349

CRITICAL · 9.8 CVSS v3.1 Published 2020-10-14
Fix available
A fix is available. Upgrade to 10.10.6.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST API management interface. This interface is disabled by default and not vulnerable unless enabled. When enabled, it is only vulnerable where attached to a VRF and as allowed by defined ACLs. Lenovo strongly recommends upgrading to a non-vulnerable CNOS release. Where not possible, Lenovo recommends disabling the REST API management interface or restricting access to the management VRF and further limiting access to authorized management stations via ACL.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Lenovo CNOS contains an unauthenticated remote code execution vulnerability in its optional REST API management interface. When enabled and attached to a VRF, an attacker can execute arbitrary code without authentication if the request passes through configured ACLs.

MitigationUpgrade to a non-vulnerable CNOS release, or disable the REST API management interface, or restrict access to the management VRF and limit to authorized management stations via ACL.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Cloud Networking Operating SystemOperating system
Affected:< 10.10.6.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify CNOS version
    Access the device CLI and run 'show version' or 'show running-config | include version' to obtain the installed Cloud Networking Operating System version
    Affected if The displayed version is less than 10.10.6.0 (for example, 10.10.5.0 or earlier)
  2. Confirm REST API is enabled
    Run 'show rest-api status' or check the running configuration for 'rest-api' under the management interface settings
    Affected if The REST API management interface is listed as enabled or active in the configuration
  3. Check REST API VRF binding
    Run 'show rest-api vrf' or examine the REST API configuration to determine which VRF the interface is bound to
    Affected if The REST API is attached to any VRF (including the default VRF or a management VRF)
  4. Review ACL configuration for REST API
    Run 'show access-lists' or 'show rest-api access-list' to inspect the configured ACL rules permitting or denying REST API traffic
    Affected if ACLs are configured but may not adequately restrict access to authorized management stations only

Your environment is affected if the CNOS version is below 10.10.6.0 AND the optional REST API management interface is enabled and attached to a VRF, regardless of ACL configuration

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 10.10.6.0 or later
Fixed in 10.10.6.0
Interim mitigation

Upgrade to a non-vulnerable CNOS release, or disable the REST API management interface, or restrict access to the management VRF and limit to authorized management stations via ACL.

Recommended fix High confidence

10.10.6.0 or later

  1. 1. Identify the current Cloud Networking Operating System (CNOS) version by running 'show version' or checking the system information.
  2. 2. Plan an upgrade window and backup the current configuration using 'copy running-config startup-config' or 'write memory'.
  3. 3. Download the CNOS version 10.10.6.0 or later from Lenovo support (support.lenovo.com).
  4. 4. Upgrade the CNOS device to version 10.10.6.0 or later following the standard firmware upgrade procedure.
  5. 5. After upgrade, verify the new version is installed by running 'show version'.
  6. 6. Confirm the REST API management interface is still disabled (default state) or, if required, ensure proper VRF and ACL restrictions are in place.
  7. 7. Test that normal network operations and management functions are working correctly.
Caveat Standard firmware upgrade may cause brief data plane interruption; ensure configuration backup before upgrade

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Cloud Networking Operating System Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing2.0 h
  • Review / QA1.0 h
9.0 hours of engineering $1,600
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,560.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-8349 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-8349 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data