CVE-2020-3527

Cisco Catalyst 9200 Series Switches Jumbo Frame Denial of Service Vulnerability

A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerability is due to insufficient packet size validation. An attacker could exploit this vulnerability by sending jumbo frames or frames larger than the configured MTU size to the management interface of this device. A successful exploit could allow the attacker to crash the device fully before an automatic recovery.

CVSS 3.1 · 8.6 High EPSS 1.4% KEV · Not listed

Vendors

Cisco

Products

Catalyst C9200l-24p-4g Catalyst C9200l-24p-4x Catalyst C9200l-24pxg-2y and 10 more

CVE-2020-3512

Cisco IOS and IOS XE Software PROFINET Link Layer Discovery Protocol Denial of Service Vulnerability

A vulnerability in the PROFINET handler for Link Layer Discovery Protocol (LLDP) messages of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a crash on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of LLDP messages in the PROFINET LLDP message handler. An attacker could exploit this vulnerability by sending a malicious LLDP message to an affected device. A successful exploit could allow the attacker to cause the affected device to reload.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Catalyst 3650-12x48uq Catalyst 3650-12x48ur Catalyst 3650-12x48uz and 129 more

CVE-2020-3510

Cisco IOS XE Software for Catalyst 9200 Series Switches Umbrella Connector Denial of Service Vulnerability

A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to trigger a reload, resulting in a denial of service condition on an affected device. The vulnerability is due to insufficient error handling when parsing DNS requests. An attacker could exploit this vulnerability by sending a series of malicious DNS requests to an Umbrella Connector client interface of an affected device. A successful exploit could allow the attacker to cause a crash of the iosd process, which triggers a reload of the affected device.

CVSS 3.1 · 8.6 High EPSS 1.4% KEV · Not listed

Vendors

Cisco

Products

Catalyst C9200-24p Catalyst C9200-24t Catalyst C9200-48p and 48 more

CVE-2020-3508

Cisco IOS XE Software for Cisco ASR 1000 Series 20-Gbps Embedded Services Processor IP ARP Denial of Service Vulnerability

A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-Gbps Embedded Services Processor (ESP) installed could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service condition. The vulnerability is due to insufficient error handling when an affected device has reached platform limitations. An attacker could exploit this vulnerability by sending a malicious series of IP ARP messages to an affected device. A successful exploit could allow the attacker to exhaust system resources, which would eventually cause the affected device to reload.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

1000v 1100-4g Integrated Services Router 1100-4gltegb Integrated Services Router and 138 more

CVE-2020-3505

Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulnerability

A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of certain Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending certain Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DOS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

8000p Ip Camera 8000p Ip Camera Firmware 8020 Ip Camera and 13 more

CVE-2020-3504

Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability

A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI command parameters. An attacker could exploit this vulnerability by executing specific commands on the local-mgmt CLI on an affected device. A successful exploit could allow the attacker to cause internal system processes to fail to terminate properly, which could result in a buildup of stuck processes and lead to slowness in accessing the UCS Manager CLI and web UI. A sustained attack may result in a restart of internal UCS Manager processes and a temporary loss of access to the UCS Manager CLI and web UI.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Firepower 1010 Firepower 1120 Firepower 1140 and 105 more

CVE-2020-3487

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service Vulnerabilities

Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of an affected device. These vulnerabilities are due to insufficient validation of CAPWAP packets. An attacker could exploit these vulnerabilities by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition on the affected device.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Catalyst 9115 Ap Catalyst 9117 Ap Catalyst 9120 Ap and 7 more

CVE-2020-3479

Cisco IOS and IOS XE Software MP-BGP EVPN Denial of Service Vulnerability

A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of Border Gateway Protocol (BGP) update messages that contain crafted EVPN attributes. An attacker could exploit this vulnerability by sending BGP update messages with specific, malformed attributes to an affected device. A successful exploit could allow the attacker to cause an affected device to crash, resulting in a DoS condition.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed

Vendors

Cisco

Products

1100 Integrated Services Router 1101 Integrated Services Router 1109 Integrated Services Router and 23 more

CVE-2020-3428

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family WLAN Local Profiling Denial of Service Vulnerability

A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect parsing of HTTP packets while performing HTTP-based endpoint device classifications. An attacker could exploit this vulnerability by sending a crafted HTTP packet to an affected device. A successful exploit could cause an affected device to reboot, resulting in a DoS condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

1100 Integrated Services Router 1101 Integrated Services Router 1109 Integrated Services Router and 71 more

CVE-2020-3414

Cisco IOS XE Software for Cisco 4461 Integrated Services Routers Denial of Service Vulnerability

A vulnerability in the packet processing of Cisco IOS XE Software for Cisco 4461 Integrated Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect processing of IPv4 or IPv6 traffic to or through an affected device. An attacker could exploit this vulnerability by sending IP traffic to or through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

CVSS 3.1 · 8.6 High EPSS 1.9% KEV · Not listed

Vendors

Cisco

Products

4461 Integrated Services Router Ios Xe

CVE-2020-3409

Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability

A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ie-3200-8p2s-e Ie-3200-8t2s-e Ie-3300-8p2s-a and 32 more

CVE-2020-3408

Cisco IOS and IOS XE Software Split DNS Denial of Service Vulnerability

A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of affected releases may time out when it processes the DNS name list configuration. An attacker could exploit this vulnerability by trying to resolve an address or hostname that the affected device handles. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

CVSS 3.1 · 8.6 High EPSS 1.6% KEV · Not listed

Vendors

Cisco

Products

1100-4g Integrated Services Router 1100-4gltegb Integrated Services Router 1100-4gltena Integrated Services Router and 126 more

CVE-2020-3372

Cisco SD-WAN vManage Software Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to the affected web-based management interface. A successful exploit could allow the attacker to exhaust system memory, which could cause the system to stop processing new connections and could result in a DoS condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

1100-4g Integrated Services Router 1100-4gltegb Integrated Services Router 1100-4gltena Integrated Services Router and 9 more

CVE-2020-3351

Cisco SD-WAN Solution Software Denial of Service Vulnerability

A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper validation of fields in Cisco SD-WAN peering messages that are encapsulated in UDP packets. An attacker could exploit this vulnerability by sending crafted UDP messages to the targeted system. A successful exploit could allow the attacker to cause services on the device to fail, resulting in a DoS condition that could impact the targeted device and other devices that depend on it.

CVSS 3.1 · 8.6 High EPSS 1.4% KEV · Not listed

Vendors

Cisco

Products

Sd-wan Firmware Vedge 100 Vedge 1000 and 7 more

CVE-2020-3338

Cisco NX-OS Software IPv6 Protocol Independent Multicast Denial of Service Vulnerability

A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper error handling when processing inbound PIM6 packets. An attacker could exploit this vulnerability by sending multiple crafted PIM6 packets to an affected device. A successful exploit could allow the attacker to cause the PIM6 application to leak system memory. Over time, this memory leak could cause the PIM6 application to stop processing legitimate PIM6 traffic, leading to a DoS condition on the affected device.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Cisco

Products

Nexus 3016 Nexus 3048 Nexus 3064 and 64 more

CVE-2020-3260

Cisco Aironet Series Access Points Client Packet Processing Denial of Service Vulnerability

A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of client packets that are sent to an affected access point (AP). An attacker could exploit this vulnerability by sending a large number of sustained client packets to the affected AP. A successful exploit could allow the attacker to cause the affected AP to crash, resulting in a DoS condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Aironet 1542d Aironet 1542d Firmware Aironet 1542i and 9 more

CVE-2020-3203

Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability

A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain public key infrastructure (PKI) packets. An attacker could exploit this vulnerability by sending crafted Secure Sockets Layer (SSL) packets to an affected device. A successful exploit could cause an affected device to continuously consume memory, which could result in a memory allocation failure that leads to a crash and causes a DoS condition.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Catalyst 9800-40 Catalyst 9800-80 Catalyst 9800-cl and 4 more

CVE-2020-3190

Cisco IOS XR Software IPsec Packet Processor Denial of Service Vulnerability

A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition for IPsec sessions to an affected device. The vulnerability is due to improper handling of packets by the IPsec packet processor. An attacker could exploit this vulnerability by sending malicious ICMP error messages to an affected device that get punted to the IPsec packet processor. A successful exploit could allow the attacker to deplete IPsec memory, resulting in all future IPsec packets to an affected device being dropped by the device. Manual intervention is required to recover from this situation.

CVSS 3.1 · 5.8 Medium EPSS 1.3% KEV · Not listed

Vendors

Cisco

Products

Ios Xr

CVE-2020-3181

Cisco Email Security Appliance Uncontrolled Resource Exhaustion Vulnerability

A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated remote attacker to exhaust resources on an affected device. The vulnerability is due to insufficient control over system memory allocation. An attacker could exploit this vulnerability by sending a crafted email through the targeted device. A successful exploit could allow the attacker to cause an email attachment that contains malware to be delivered to a user and cause email processing delays.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Cisco

Products

Email Security Appliance

CVE-2020-3175

Cisco MDS 9000 Series Multilayer Switches Denial of Service Vulnerability

A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource usage control. An attacker could exploit this vulnerability by sending traffic to the management interface (mgmt0) of an affected device at very high rates. An exploit could allow the attacker to cause unexpected behaviors such as high CPU usage, process crashes, or even full system reboots of an affected device.

CVSS 3.1 · 8.6 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Mds 9132t Mds 9148s Mds 9148t and 11 more