CVE-2020-3170

published 2020-02-26

CVE-2020-3170: A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly…

Priority P4 32 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I N A L

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API on an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition in the NX-API service; however, the Cisco NX-OS device itself would still be available and passing network traffic. Note: The NX-API feature is disabled by default.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_nx-os_software_7.3_d1	>= unspecified < n/a	n/a
cisco	nx-os	< 8.4\(1\)	8.4\(1\)
cisco	nx-os	< 8.2\(5\)	8.2\(5\)
cisco	nx-os	—	—

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

nvd v3.0 5.3 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:N/A:P

vendor_cisco 5.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20