1. Home
  2. CVE Database
  3. CVE-2020-3172
HIGH · 8.8

CVE-2020-3172

A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code as root or cause a d...

Vulnerability Description

A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code as root or cause a denial of service (DoS) condition on an affected device. The vulnerability exists because of insufficiently validated Cisco Discovery Protocol packet headers. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device. A successful exploit could allow the attacker to cause a buffer overflow that could allow the attacker to execute arbitrary code as root or cause a DoS condition on the affected device. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Note: This vulnerability is different from the following Cisco FXOS and NX-OS Software Cisco Discovery Protocol vulnerabilities that Cisco announced on Feb. 5, 2020: Cisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service Vulnerability and Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CiscoFirepower Extensible Operating System< 2.6.1.187
CiscoFirepower 4110-
CiscoFirepower 4115-
CiscoFirepower 4120-
CiscoFirepower 4125-
CiscoFirepower 4140-
CiscoFirepower 4145-
CiscoFirepower 4150-
CiscoFirepower 9300-
CiscoUcs Manager< 3.2\(3n\)
CiscoUcs 6248Up-
CiscoUcs 6296Up-
CiscoUcs 6324-
CiscoUcs 6332-
CiscoUcs 6332-16Up-
CiscoNx-Os-
CiscoMds 9132T-
CiscoMds 9148S-
CiscoMds 9148T-
CiscoMds 9216-

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2020-3172?

CVE-2020-3172 is a vulnerability with a CVSS score of 8.8 (HIGH). A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code as root or cause a d...

How severe is CVE-2020-3172?

CVE-2020-3172 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-3172?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Firepower Extensible Operating System, Cisco Firepower 4110, Cisco Firepower 4115, Cisco Firepower 4120, Cisco Firepower 4125.