CVE-2020-3203 — Uncontrolled Resource Consumption in Cisco IOS XE Software 16.1.1

CWE-400 — Uncontrolled Resource ConsumptionCWE-401 — Missing Release of Memory after Effective Lifetime4 documents4 sources
Severity
8.6HIGHNVD
EPSS
0.8%
top 26.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE Software 16.1.1Cisco IOS XE
Timeline
PublishedJun 3
Latest updateMay 24

Description

A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain public key infrastructure (PKI) packets. An attacker could exploit this vulnerability by sending crafted Secure Sockets Layer (SSL) packets t…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶NVDcisco/ios_xe54 versions+53

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-j6v9-29xf-j8q4: A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running↗2022-05-24
▶
CVEList
Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability↗2020-06-03
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability↗2020-06-03
▶
CVE-2020-3203 — Uncontrolled Resource Consumption | cvebase