Vulnerability Description
A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Sd-Wan Firmware | < 18.4.5 |
| Cisco | Vedge Cloud Router | - |
| Cisco | Vmanage Network Management System | - |
| Cisco | Vsmart Controller | - |
| Cisco | 1100-4G Integrated Services Router | - |
| Cisco | 1100-4Gltegb Integrated Services Router | - |
| Cisco | 1100-4Gltena Integrated Services Router | - |
| Cisco | 1100-6G Integrated Services Router | - |
| Cisco | Vedge 100 | - |
| Cisco | Vedge 1000 | - |
| Cisco | Vedge 100B | - |
| Cisco | Vedge 100M | - |
| Cisco | Vedge 100Wm | - |
| Cisco | Vedge 2000 | - |
| Cisco | Vedge 5000 | - |
Related Weaknesses (CWE)
References
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-wwq2-ExploitThird Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sVendor Advisory
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-wwq2-ExploitThird Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sVendor Advisory
FAQ
What is CVE-2020-3264?
CVE-2020-3264 is a vulnerability with a CVSS score of 7.1 (HIGH). A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validati...
How severe is CVE-2020-3264?
CVE-2020-3264 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-3264?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Sd-Wan Firmware, Cisco Vedge Cloud Router, Cisco Vmanage Network Management System, Cisco Vsmart Controller, Cisco 1100-4G Integrated Services Router.