PT-2020-4163 · Cisco · Cisco 800 Series Industrial Integrated Services Routers+2
Published
2020-09-24
·
Updated
2021-08-06
·
CVE-2020-3426
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Cisco 800 Series Industrial Integrated Services Routers (affected versions not specified)
Cisco 1000 Series Connected Grid Routers (affected versions not specified)
Description:
The issue is related to errors in privilege management in the implementation of the Low-power Wide-area Network (LPWAN) technology in Cisco IOS Software. This could allow a remote attacker to gain unauthorized access to sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to a lack of input and validation checking mechanisms for virtual-LPWA (VLPWA) protocol modem messages. An attacker could exploit this vulnerability by supplying crafted packets to an affected device, potentially gaining unauthorized read access to sensitive data or causing the VLPWA interface to shut down.
Recommendations:
For Cisco 800 Series Industrial Integrated Services Routers, update to a version that includes the fix for this issue.
For Cisco 1000 Series Connected Grid Routers, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the VLPWA interface until a patch is available.
Avoid using the VLPWA protocol until the issue is resolved.
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco 1000 Series Connected Grid Routers
Cisco 800 Series Industrial Integrated Services Routers
Cisco Ios