Vulnerability Description
A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-Gbps Embedded Services Processor (ESP) installed could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service condition. The vulnerability is due to insufficient error handling when an affected device has reached platform limitations. An attacker could exploit this vulnerability by sending a malicious series of IP ARP messages to an affected device. A successful exploit could allow the attacker to exhaust system resources, which would eventually cause the affected device to reload.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | 16.3.1 |
| Cisco | 1000V | - |
| Cisco | 4321 Integrated Services Router | - |
| Cisco | 4331 Integrated Services Router | - |
| Cisco | 4351 Integrated Services Router | - |
| Cisco | 4431 Integrated Services Router | - |
| Cisco | Asr 1000 | - |
| Cisco | Asr 1001-Hx | - |
| Cisco | Asr 1001-X | - |
| Cisco | Asr 1002-Hx | - |
| Cisco | Asr 1002-X | - |
| Cisco | Catalyst 3650-12X48Fd-E | - |
| Cisco | Catalyst 3650-12X48Fd-L | - |
| Cisco | Catalyst 3650-12X48Fd-S | - |
| Cisco | Catalyst 3650-24Pd-E | - |
| Cisco | Catalyst 3650-24Pd-L | - |
| Cisco | Catalyst 3650-24Pd-S | - |
| Cisco | Catalyst 3650-24Pdm-E | - |
| Cisco | Catalyst 3650-24Pdm-L | - |
| Cisco | Catalyst 3650-24Pdm-S | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-eVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-eVendor Advisory
FAQ
What is CVE-2020-3508?
CVE-2020-3508 is a vulnerability with a CVSS score of 7.4 (HIGH). A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-Gbps Embedded Services Processor (ESP) ins...
How severe is CVE-2020-3508?
CVE-2020-3508 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-3508?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco 1000V, Cisco 4321 Integrated Services Router, Cisco 4331 Integrated Services Router, Cisco 4351 Integrated Services Router.