Lucene search

CiscoCVE-2020-3264

HistoryMar 19, 2020 - 4:15 p.m.

CVE-2020-3264

2020-03-1916:15:15

CWE-119

CWE-120

cisco

web.nvd.nist.gov

cisco

sd-wan

vulnerability

buffer overflow

nvd

cve-2020-3264

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:C/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make.

Affected configurations

Nvd

Node

ciscosd-wan_firmwareRange<18.4.5

ciscosd-wan_firmwareRange19.2.0–19.2.2

ciscosd-wan_firmwareMatch20.1.0

ciscosd-wan_firmwareMatch20.3.0

AND

ciscovedge_cloud_routerMatch-

ciscovmanage_network_management_systemMatch-

ciscovsmart_controllerMatch-

cisco1100-4g_integrated_services_routerMatch-

cisco1100-4gltegb_integrated_services_routerMatch-

cisco1100-4gltena_integrated_services_routerMatch-

cisco1100-6g_integrated_services_routerMatch-

ciscovedge_100Match-

ciscovedge_1000Match-

ciscovedge_100bMatch-

ciscovedge_100mMatch-

ciscovedge_100wmMatch-

ciscovedge_2000Match-

ciscovedge_5000Match-

VendorProductVersionCPE
ciscosd-wan_firmware*cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*
ciscosd-wan_firmware20.1.0cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:*:*:*:*:*:*:*
ciscosd-wan_firmware20.3.0cpe:2.3:o:cisco:sd-wan_firmware:20.3.0:*:*:*:*:*:*:*
ciscovedge_cloud_router-cpe:2.3:a:cisco:vedge_cloud_router:-:*:*:*:*:*:*:*
ciscovmanage_network_management_system-cpe:2.3:a:cisco:vmanage_network_management_system:-:*:*:*:*:*:*:*
ciscovsmart_controller-cpe:2.3:a:cisco:vsmart_controller:-:*:*:*:*:*:*:*
cisco1100-4g_integrated_services_router-cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4gltegb_integrated_services_router-cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4gltena_integrated_services_router-cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-6g_integrated_services_router-cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	sd-wan_firmware	*	cpe:2.3:o:cisco:sd-wan_firmware::::::::
cisco	sd-wan_firmware	20.1.0	cpe:2.3:o:cisco:sd-wan_firmware:20.1.0:::::::*
cisco	sd-wan_firmware	20.3.0	cpe:2.3:o:cisco:sd-wan_firmware:20.3.0:::::::*
cisco	vedge_cloud_router	-	cpe:2.3:a:cisco:vedge_cloud_router:-:::::::*
cisco	vmanage_network_management_system	-	cpe:2.3:a:cisco:vmanage_network_management_system:-:::::::*
cisco	vsmart_controller	-	cpe:2.3:a:cisco:vsmart_controller:-:::::::*
cisco	1100-4g_integrated_services_router	-	cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:::::::*
cisco	1100-4gltegb_integrated_services_router	-	cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:::::::*
cisco	1100-4gltena_integrated_services_router	-	cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:::::::*
cisco	1100-6g_integrated_services_router	-	cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:::::::*

Rows per page:

1-10 of 171

CNA Affected

[
  {
    "product": "Cisco SD-WAN Solution",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

github.com/orangecertcc/security-research/security/advisories/GHSA-wwq2-pxrj-v62r

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwanbo-QKcABnS2

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:C/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2020-3264