Lucene search

K
cve[email protected]CVE-2020-3479
HistorySep 24, 2020 - 6:15 p.m.

CVE-2020-3479

2020-09-2418:15:20
CWE-400
CWE-20
web.nvd.nist.gov
27
cisco
ios
xe
mp-bgp
vulnerability
dos
nvd
cve-2020-3479

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.002 Low

EPSS

Percentile

52.6%

A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of Border Gateway Protocol (BGP) update messages that contain crafted EVPN attributes. An attacker could exploit this vulnerability by sending BGP update messages with specific, malformed attributes to an affected device. A successful exploit could allow the attacker to cause an affected device to crash, resulting in a DoS condition.

Affected configurations

NVD
Node
ciscoiosMatch-
OR
ciscoios_xeMatch-
AND
cisco1100_integrated_services_routerMatch-
OR
cisco1101_integrated_services_routerMatch-
OR
cisco1109_integrated_services_routerMatch-
OR
cisco1111x_integrated_services_routerMatch-
OR
cisco111x_integrated_services_routerMatch-
OR
cisco1120_integrated_services_routerMatch-
OR
cisco1160_integrated_services_routerMatch-
OR
cisco4221_integrated_services_routerMatch-
OR
cisco4321_integrated_services_routerMatch-
OR
cisco4331_integrated_services_routerMatch-
OR
cisco4351_integrated_services_routerMatch-
OR
cisco4431_integrated_services_routerMatch-
OR
cisco4451-x_integrated_services_routerMatch-
OR
cisco4461_integrated_services_routerMatch-
OR
ciscoasr_1001-hxMatch-
OR
ciscoasr_1001-xMatch-
OR
ciscoasr_1002-hxMatch-
OR
ciscoasr_1002-xMatch-
OR
ciscoasr_1004Match-
OR
ciscoasr_1006Match-
OR
ciscoasr_1006-xMatch-
OR
ciscoasr_1009-xMatch-
OR
ciscoasr_1013Match-
OR
ciscocloud_services_router_1000vMatch-

CNA Affected

[
  {
    "product": "Cisco IOS 15.2(5)E1",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.002 Low

EPSS

Percentile

52.6%

Related for CVE-2020-3479