1. Home
  2. CVE Database
  3. CVE-2020-3527
HIGH · 8.6

CVE-2020-3527

A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerability is due to insufficient packet size v...

Vulnerability Description

A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerability is due to insufficient packet size validation. An attacker could exploit this vulnerability by sending jumbo frames or frames larger than the configured MTU size to the management interface of this device. A successful exploit could allow the attacker to crash the device fully before an automatic recovery.

CVSS Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
CiscoIos Xe>= 16.9.0, < 16.9.5
CiscoCatalyst C9200L-24P-4G-
CiscoCatalyst C9200L-24P-4X-
CiscoCatalyst C9200L-24Pxg-2Y-
CiscoCatalyst C9200L-24Pxg-4X-
CiscoCatalyst C9200L-24T-4G-
CiscoCatalyst C9200L-24T-4X-
CiscoCatalyst C9200L-48P-4G-
CiscoCatalyst C9200L-48P-4X-
CiscoCatalyst C9200L-48Pxg-2Y-
CiscoCatalyst C9200L-48Pxg-4X-
CiscoCatalyst C9200L-48T-4G-
CiscoCatalyst C9200L-48T-4X-

Related Weaknesses (CWE)

CWE-20CWE-400

References

FAQ

What is CVE-2020-3527?

CVE-2020-3527 is a vulnerability with a CVSS score of 8.6 (HIGH). A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerability is due to insufficient packet size v...

How severe is CVE-2020-3527?

CVE-2020-3527 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-3527?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco Catalyst C9200L-24P-4G, Cisco Catalyst C9200L-24P-4X, Cisco Catalyst C9200L-24Pxg-2Y, Cisco Catalyst C9200L-24Pxg-4X.