Lucene search

[email protected]CVE-2020-3358

HistoryJul 16, 2020 - 6:15 p.m.

CVE-2020-3358

2020-07-1618:15:18

CWE-20

[email protected]

web.nvd.nist.gov

cve-2020-3358

vulnerability

ssl vpn

cisco

small business

rv vpn routers

denial of service

dos

input validation

http request

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.3%

JSON

A vulnerability in the Secure Sockets Layer (SSL) VPN feature for Cisco Small Business RV VPN Routers could allow an unauthenticated, remote attacker to cause the device to unexpectedly restart, causing a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request over an SSL connection to the targeted device. A successful exploit could allow the attacker to cause a reload, resulting in a DoS condition.

Affected configurations

NVD

Node

ciscorv340_dual_wan_gigabit_vpn_router_firmwareRange<1.0.03.18

AND

ciscorv340_dual_wan_gigabit_vpn_routerMatch-

Node

ciscorv340w_dual_wan_gigabit_wireless-ac_vpn_router_firmwareRange<1.0.03.18

AND

ciscorv340w_dual_wan_gigabit_wireless-ac_vpn_routerMatch-

Node

ciscorv345_dual_wan_gigabit_vpn_router_firmwareRange<1.0.03.18

AND

ciscorv345_dual_wan_gigabit_vpn_routerMatch-

Node

ciscorv345p_dual_wan_gigabit_poe_vpn_router_firmwareRange<1.0.03.18

AND

ciscorv345p_dual_wan_gigabit_poe_vpn_routerMatch-

CPENameOperatorVersion
cisco:rv340_dual_wan_gigabit_vpn_router_firmwarecisco rv340 dual wan gigabit vpn router firmwarelt1.0.03.18

CPE	Name	Operator	Version
cisco:rv340_dual_wan_gigabit_vpn_router_firmware	cisco rv340 dual wan gigabit vpn router firmware	lt	1.0.03.18

CNA Affected

[
  {
    "product": "Cisco Small Business RV Series Router Firmware ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-dos-ZN5GvNH7

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.3%

JSON

Related for CVE-2020-3358

nessus1 cvelist1 prion1 nvd1 cisco1