Medium severity · published Feb 5, 2020
CVE-2020-3120
A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent…
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a missing check when the affected software processes Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to exhaust system memory, causing the device to reload. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Firepower Extensible Operating System · Cisco
through 2.3.1.173; 2.6 before 2.6.1.187; 2.7 before 2.7.1.106 · source: NVD
FX
Fxos · Cisco
2.4 · source: NVD
IX
Ios XR · Cisco
5.2.5; 6.4.2; 6.5.3; 6.6.25; 7.0.1 · source: NVD
NX
Nx-os · Cisco
5.2 before 6.2\(29\); 7.3 before 8.4\(1a\); 5.2 before 5.2\(1\)sv5\(1.3\); through 5.2; before 5.2\(1\)sv3\(4.1b\); 7.0\(3\)f2 before 9.3\(2\); +8 more · source: NVD
UM
Ucs Manager · Cisco
before 3.2\(3m\); 4.0 before 4.0\(4g\) · source: NVD
Affected product
FE
Firepower Extensible Operating System
Cisco
More from Firepower Extensible Operating System
9.8
CVE-2018-0310
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to obtain sensitive…
9.8
CVE-2015-6435
An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0…
8.8
CVE-2021-1368
A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute…
8.8
CVE-2020-3456
A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF)…
8.8
CVE-2020-3172
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code…