1. Home
  2. CVE Database
  3. CVE-2020-3415
HIGH · 8.8

CVE-2020-3415

A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial...

Vulnerability Description

A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the Cisco Discovery Protocol process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Exploitation of this vulnerability also requires jumbo frames to be enabled on the interface that receives the crafted Cisco Discovery Protocol packets on the affected device.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CiscoNx-Os-
CiscoNexus 3016-
CiscoNexus 3048-
CiscoNexus 3064-
CiscoNexus 3064-T-
CiscoNexus 31108Pc-V-
CiscoNexus 31108Tc-V-
CiscoNexus 31128Pq-
CiscoNexus 3132C-Z-
CiscoNexus 3132Q-
CiscoNexus 3132Q-V-
CiscoNexus 3132Q-Xl-
CiscoNexus 3164Q-
CiscoNexus 3172-
CiscoNexus 3172Pq-Xl-
CiscoNexus 3172Tq-
CiscoNexus 3172Tq-32T-
CiscoNexus 3172Tq-Xl-
CiscoNexus 3232C-
CiscoNexus 3264C-E-

Related Weaknesses (CWE)

CWE-787

References

FAQ

What is CVE-2020-3415?

CVE-2020-3415 is a vulnerability with a CVSS score of 8.8 (HIGH). A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial...

How severe is CVE-2020-3415?

CVE-2020-3415 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-3415?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Nx-Os, Cisco Nexus 3016, Cisco Nexus 3048, Cisco Nexus 3064, Cisco Nexus 3064-T.