PT-2020-5093 · Cisco · Cisco Industrial Network Director

Published 2020-10-07 · Updated 2021-10-19 · CVE-2020-3567

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director (affected versions not specified)

Description A vulnerability in the management REST API of Cisco Industrial Network Director could allow an authenticated, remote attacker to cause the CPU utilization to increase to 100 percent, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of requests sent to the REST API. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to cause a permanent DoS condition that is due to high CPU utilization. Manual intervention may be required to recover the Cisco IND.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-05686

CVE-2020-3567

Affected Products

Cisco Industrial Network Director

References · 5

• https://bdu.fstec.ru/vul/2020-05686 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-dos-BwG634zn · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3567 · Security Note
• https://t.me/cibsecurity/15141 · Telegram Post