CVE-2020-3526 — Improper Input Validation in Cisco IOS XE Software

CWE-20 — Improper Input Validation4 documents4 sources

Severity

8.6HIGHNVD

EPSS

0.6%

top 31.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XE Software Cisco IOS XE

Timeline

PublishedSep 24

Latest updateMay 24

Description

A vulnerability in the Common Open Policy Service (COPS) engine of Cisco IOS XE Software on Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to crash a device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a malformed COPS message to the device. A successful exploit could allow the attacker to crash the device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_softwaren/a

▶NVDcisco/ios_xe17.2

🔴Vulnerability Details

GHSA

GHSA-x9r4-mp46-hrqx: A vulnerability in the Common Open Policy Service (COPS) engine of Cisco IOS XE Software on Cisco cBR-8 Converged Broadband Routers could allow an una↗2022-05-24

▶

CVEList

Cisco IOS XE Software Common Open Policy Service Engine Denial of Service Vulnerability↗2020-09-24

▶

📋Vendor Advisories

Cisco

Cisco IOS XE Software Common Open Policy Service Engine Denial of Service Vulnerability↗2020-09-24

▶