PT-2020-2877 · Cisco · Cisco Identity Services Engine

Published 2020-06-03 · Updated 2020-06-11 · CVE-2020-3353

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) (affected versions not specified)

Description A vulnerability in the syslog processing engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue is due to a race condition that may occur when syslog messages are processed. An attacker could exploit this by sending a high rate of syslog messages to an affected device, potentially causing the Application Server process to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2020-03034

CVE-2020-3353

Affected Products

Cisco Identity Services Engine

References · 4

• https://osv.dev/vulnerability/CVE-2020-3353 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03034 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-dos-qNzq39K7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3353 · Security Note