CVE-2020-3118 : A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

Published 2020-02-05 18:15:11

Updated 2022-12-23 16:59:18

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionExecute code

Products affected by CVE-2020-3118

Cisco » Ios Xr
Versions from including (>=) 7.0.0 and before (<) 7.0.2
cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xr
Versions from including (>=) 6.6.0 and before (<) 6.6.12
cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xr » Version: 5.2.5
cpe:2.3:o:cisco:ios_xr:5.2.5:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ncs 6000 » Version: N/A
When used together with: Cisco » Ncs 6008 » Version: N/A
Cisco » Ios Xr » Version: 6.6.25
cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ncs 560 » Version: N/A
Cisco » Ios Xr » Version: 7.0.1
cpe:2.3:o:cisco:ios_xr:7.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ncs 540l » Version: N/A
Cisco » Ios Xr » Version: 6.5.3
cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Asr 9000v » Version: N/A
When used together with: Cisco » Asr 9001 » Version: N/A
When used together with: Cisco » Asr 9006 » Version: N/A
When used together with: Cisco » Asr 9010 » Version: N/A
When used together with: Cisco » Asr 9901 » Version: N/A
When used together with: Cisco » Asr 9904 » Version: N/A
When used together with: Cisco » Asr 9906 » Version: N/A
When used together with: Cisco » Asr 9910 » Version: N/A
When used together with: Cisco » Asr 9912 » Version: N/A
When used together with: Cisco » Asr 9922 » Version: N/A
When used together with: Cisco » Ncs 540-12z20g-sys-a » Version: N/A
When used together with: Cisco » Ncs 540-12z20g-sys-d » Version: N/A
When used together with: Cisco » Ncs 540-24z8q2c-sys » Version: N/A
When used together with: Cisco » Ncs 540-28z4c-sys-a » Version: N/A
When used together with: Cisco » Ncs 540-28z4c-sys-d » Version: N/A
When used together with: Cisco » Ncs 540-acc-sys » Version: N/A
When used together with: Cisco » Ncs 540x-12z16g-sys-a » Version: N/A
When used together with: Cisco » Ncs 540x-12z16g-sys-d » Version: N/A
When used together with: Cisco » Ncs 540x-16z4g8q2c-a » Version: N/A
When used together with: Cisco » Ncs 540x-16z4g8q2c-d » Version: N/A
When used together with: Cisco » Ncs 540x-acc-sys » Version: N/A
When used together with: Cisco » Ncs 5501 » Version: N/A
When used together with: Cisco » Ncs 5501-se » Version: N/A
When used together with: Cisco » Ncs 5502 » Version: N/A
When used together with: Cisco » Ncs 5502-se » Version: N/A
When used together with: Cisco » Ncs 5508 » Version: N/A
When used together with: Cisco » Ncs 5516 » Version: N/A
When used together with: Cisco » Xrv 9000 » Version: N/A
Cisco » Ios Xr » Version: 6.4.2
cpe:2.3:o:cisco:ios_xr:6.4.2:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Asr 9000 » Version: N/A
When used together with: Cisco » Asr 9000v » Version: N/A
When used together with: Cisco » Asr 9001 » Version: N/A
When used together with: Cisco » Asr 9006 » Version: N/A
When used together with: Cisco » Asr 9010 » Version: N/A
When used together with: Cisco » Asr 9901 » Version: N/A
When used together with: Cisco » Asr 9903 » Version: N/A
When used together with: Cisco » Asr 9904 » Version: N/A
When used together with: Cisco » Asr 9906 » Version: N/A
When used together with: Cisco » Asr 9910 » Version: N/A
When used together with: Cisco » Asr 9912 » Version: N/A
When used together with: Cisco » Asr 9920 » Version: N/A
When used together with: Cisco » Asr 9922 » Version: N/A
When used together with: Cisco » Crs-x » Version: N/A

CVE-2020-3118 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Cisco IOS XR Software Discovery Protocol Format String Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2020-3118

Added on 2021-11-03 Action due date 2022-05-03

Exploit prediction scoring system (EPSS) score for CVE-2020-3118

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3118

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.3	HIGH	AV:A/AC:L/Au:N/C:C/I:C/A:C	6.5	10.0	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	Cisco Systems, Inc.
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-3118

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: ykramarz@cisco.com (Secondary)
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-3118

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce

Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
Vendor Advisory
http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html

Cisco Discovery Protocol (CDP) Remote Device Takeover ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url