CVE-2020-3118

high · 8.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2021-11-03Remediation due 2022-05-03

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

8.8

CVSS

11.7%

EPSS (exploit prob.)

96th

EPSS percentile

2020-02-05

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-134CWE-787

Affected products

Vendor	Product	Affected versions
cisco	ios_xr	>= 6.6.0, < 6.6.12
cisco	ios_xr	>= 7.0.0, < 7.0.2
cisco	ios_xr	6.5.3
cisco	asr_9000v	all versions
cisco	asr_9001	all versions
cisco	asr_9006	all versions
cisco	asr_9010	all versions
cisco	asr_9901	all versions
cisco	asr_9904	all versions
cisco	asr_9906	all versions
cisco	asr_9910	all versions
cisco	asr_9912	all versions
cisco	asr_9922	all versions
cisco	ncs_540-12z20g-sys-a	all versions
cisco	ncs_540-12z20g-sys-d	all versions
cisco	ncs_540-24z8q2c-sys	all versions
cisco	ncs_540-28z4c-sys-a	all versions
cisco	ncs_540-28z4c-sys-d	all versions
cisco	ncs_540-acc-sys	all versions
cisco	ncs_540x-12z16g-sys-a	all versions
cisco	ncs_540x-12z16g-sys-d	all versions
cisco	ncs_540x-16z4g8q2c-a	all versions
cisco	ncs_540x-16z4g8q2c-d	all versions
cisco	ncs_540x-acc-sys	all versions
cisco	ncs_5501	all versions
cisco	ncs_5501-se	all versions
cisco	ncs_5502	all versions
cisco	ncs_5502-se	all versions
cisco	ncs_5508	all versions
cisco	ncs_5516	all versions
cisco	xrv_9000	all versions
cisco	ios_xr	5.2.5
cisco	ncs_6000	all versions
cisco	ncs_6008	all versions
cisco	ios_xr	6.4.2
cisco	asr_9000	all versions
cisco	asr_9000v	all versions
cisco	asr_9001	all versions
cisco	asr_9006	all versions
cisco	asr_9010	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-3118