CVE-2020-3559 : A vulnerability in Cisco Aironet Access Point (AP) Software could allow an unaut

A vulnerability in Cisco Aironet Access Point (AP) Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper handling of clients that are trying to connect to the AP. An attacker could exploit this vulnerability by sending authentication requests from multiple clients to an affected device. A successful exploit could allow the attacker to cause the affected device to reload.

Published 2020-09-24 18:15:22

Updated 2021-04-16 15:01:40

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2020-3559

Cisco » Wireless Lan Controller
Versions from including (>=) 8.9 and before (<) 8.10.112.0
cpe:2.3:o:cisco:wireless_lan_controller:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 1111-4pwe » Version: N/A
When used together with: Cisco » 1111-8plteeawb » Version: N/A
When used together with: Cisco » 1111-8pwb » Version: N/A
When used together with: Cisco » 1113-8plteeawe » Version: N/A
When used together with: Cisco » 1113-8pmwe » Version: N/A
When used together with: Cisco » 1113-8pwe » Version: N/A
When used together with: Cisco » 1116-4plteeawe » Version: N/A
When used together with: Cisco » 1116-4pwe » Version: N/A
When used together with: Cisco » 1117-4plteeawe » Version: N/A
When used together with: Cisco » 1117-4pmlteeawe » Version: N/A
When used together with: Cisco » 1117-4pmwe » Version: N/A
When used together with: Cisco » 1117-4pwe » Version: N/A
When used together with: Cisco » Aironet 1815 » Version: N/A
When used together with: Cisco » Aironet 1830e » Version: N/A
When used together with: Cisco » Aironet 1830i » Version: N/A
When used together with: Cisco » Aironet 1850e » Version: N/A
When used together with: Cisco » Aironet 1850i » Version: N/A
When used together with: Cisco » Business 140ac » Version: N/A
When used together with: Cisco » Business 145ac » Version: N/A
When used together with: Cisco » Business 240ac » Version: N/A
Cisco » Aironet Access Point Software » Version: 8.5(151.0)
cpe:2.3:a:cisco:aironet_access_point_software:8.5\(151.0\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Aironet 1850e » Version: N/A
When used together with: Cisco » Aironet 1850i » Version: N/A
Cisco » Aironet Access Point Software » Version: 17.2.0.26
cpe:2.3:a:cisco:aironet_access_point_software:17.2.0.26:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Aironet 1850e » Version: N/A
When used together with: Cisco » Aironet 1850i » Version: N/A
Cisco » Access Points
Versions before (<) 16.12.4a
cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 9800-40 » Version: N/A
When used together with: Cisco » Catalyst 9800-80 » Version: N/A
When used together with: Cisco » Catalyst 9800-cl » Version: N/A
When used together with: Cisco » Catalyst 9800-l » Version: N/A
When used together with: Cisco » Catalyst 9800-l-c » Version: N/A
When used together with: Cisco » Catalyst 9800-l-f » Version: N/A
Cisco » Business Access Points
Versions from including (>=) 10.0 and before (<) 10.1.1.0
cpe:2.3:a:cisco:business_access_points:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-3559

EPSS FAQ

1.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 78 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3559

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
6.8	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H	2.2	4.0	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High
8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	3.9	4.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-3559

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2020-3559

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-dos-h3DCuLXw

Cisco Aironet Access Point Authentication Flood Denial of Service Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-3559

Products affected by CVE-2020-3559

Exploit prediction scoring system (EPSS) score for CVE-2020-3559

CVSS scores for CVE-2020-3559

CWE ids for CVE-2020-3559

References for CVE-2020-3559