CVE-2020-3372 : A vulnerability in the web-based management interface of Cisco SD-WAN vManage So

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to the affected web-based management interface. A successful exploit could allow the attacker to exhaust system memory, which could cause the system to stop processing new connections and could result in a DoS condition.

Published 2020-07-16 18:15:18

Updated 2023-05-23 13:55:46

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2020-3372

Cisco » Sd-wan Firmware
Versions before (<) 19.2.3
cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 1100-4g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4gltegb Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4gltena Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-6g Integrated Services Router » Version: N/A
When used together with: Cisco » Vedge 100 » Version: N/A
When used together with: Cisco » Vedge 1000 » Version: N/A
When used together with: Cisco » Vedge 100b » Version: N/A
When used together with: Cisco » Vedge 100m » Version: N/A
When used together with: Cisco » Vedge 100wm » Version: N/A
When used together with: Cisco » Vedge 2000 » Version: N/A
When used together with: Cisco » Vedge 5000 » Version: N/A
Cisco » Sd-wan Firmware
Versions from including (>=) 20.1.0 and before (<) 20.1.12
cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 1100-4g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4gltegb Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4gltena Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-6g Integrated Services Router » Version: N/A
When used together with: Cisco » Vedge 100 » Version: N/A
When used together with: Cisco » Vedge 1000 » Version: N/A
When used together with: Cisco » Vedge 100b » Version: N/A
When used together with: Cisco » Vedge 100m » Version: N/A
When used together with: Cisco » Vedge 100wm » Version: N/A
When used together with: Cisco » Vedge 2000 » Version: N/A
When used together with: Cisco » Vedge 5000 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-3372

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 43 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3372

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:N/A:P	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-3372

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2020-3372

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emvman-3y6LuTcZ

Cisco SD-WAN vManage Software Denial of Service Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-3372

Products affected by CVE-2020-3372

Exploit prediction scoring system (EPSS) score for CVE-2020-3372

CVSS scores for CVE-2020-3372

CWE ids for CVE-2020-3372

References for CVE-2020-3372