Vulnerability Details : CVE-2020-3507
Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP camera. These vulnerabilities are due to missing checks when the IP cameras process a Cisco Discovery Protocol packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to the targeted IP camera. A successful exploit could allow the attacker to execute code on the affected IP camera or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
Vulnerability category: Input validationExecute codeDenial of service
Products affected by CVE-2020-3507
- cpe:2.3:o:cisco:8000p_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8020_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8030_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8070_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8400_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8620_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8630_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:8930_speed_dome_ip_camera_firmware:1.0.9-1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-3507
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-3507
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.3
|
HIGH | AV:A/AC:L/Au:N/C:C/I:C/A:C |
6.5
|
10.0
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
Cisco Systems, Inc. | |
8.8
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2020-3507
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2020-3507
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcameras-rce-dos-uPyJYxN3
Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilitiesVendor Advisory
Jump to