CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
89.0%
A vulnerability in the Overlay Transport Virtualization (OTV) generic routing encapsulation (GRE) implementation of the Cisco Nexus 7000 and 7700 Series Switches could allow an unauthenticated, adjacent attacker to cause a reload of the affected system or to remotely execute code.
The vulnerability is due to incomplete input validation performed on the size of OTV packet header parameters, which can result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted OTV UDP packet to the OTV interface on an affected device. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the OTV related process on the affected device.
Cisco has released software updates that address this vulnerability. A workaround to mitigate this vulnerability is available.
This advisory is available at the following link:
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | nx_os | 4.1 | cpe:2.3:o:cisco:nx_os:4.1:*:*:*:*:*:*:* |
cisco | nx_os | 5.0 | cpe:2.3:o:cisco:nx_os:5.0:*:*:*:*:*:*:* |
cisco | nx_os | 4.2 | cpe:2.3:o:cisco:nx_os:4.2:*:*:*:*:*:*:* |
cisco | nx_os | 5.1 | cpe:2.3:o:cisco:nx_os:5.1:*:*:*:*:*:*:* |
cisco | nx_os | 5.2 | cpe:2.3:o:cisco:nx_os:5.2:*:*:*:*:*:*:* |
cisco | nx_os | 6.1 | cpe:2.3:o:cisco:nx_os:6.1:*:*:*:*:*:*:* |
cisco | nx_os | 6.0 | cpe:2.3:o:cisco:nx_os:6.0:*:*:*:*:*:*:* |
cisco | nx_os | 6.2 | cpe:2.3:o:cisco:nx_os:6.2:*:*:*:*:*:*:* |
cisco | nx_os | 4.1(2) | cpe:2.3:o:cisco:nx_os:4.1\(2\):*:*:*:*:*:*:* |
cisco | nx_os | 4.1(3) | cpe:2.3:o:cisco:nx_os:4.1\(3\):*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
89.0%