CVE-2020-3118 — Cisco IOS XR Software Discovery Protocol Format String Vulnerability

provenance: imported · CVE: CVE-2020-3118

CVE-2020-3118: Cisco IOS XR Software Discovery Protocol Format String Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Cisco
Product	IOS XR
Date added	2021-11-03
Due date	2022-05-03
Ransomware campaign use	Unknown

Description

Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-3118

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-3118
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog