PT-2020-4165 · Cisco · Cisco Ios Xe

Published 2020-09-24 · Updated 2023-05-23 · CVE-2020-3407

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG feature. An attacker could exploit this vulnerability by accessing the device using RESTCONF or NETCONF-YANG. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2020-04587

CVE-2020-3407

Affected Products

Cisco Ios Xe

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confacl-HbPtfSuO · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3407 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confacl-HbPtfSuO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3407 · Security Note
• https://bdu.fstec.ru/vul/2020-04587 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/657130 · Security Note