CVE-2020-3118: Cisco IOS XR Software Discovery Protocol Format String Vulnerability
First published: Wed Feb 05 2020(Updated: )
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XR | >=6.6.0<6.6.12 | |
| Cisco IOS XR | >=7.0.0<7.0.2 | |
| Cisco IOS XR | =6.5.3 | |
| Cisco Asr 9000v | ||
| Cisco Asr 9001 | ||
| Cisco Asr 9006 | ||
| Cisco Asr 9010 | ||
| Cisco Asr 9901 | ||
| Cisco Asr 9904 | ||
| Cisco Asr 9906 | ||
| Cisco Asr 9910 | ||
| Cisco Asr 9912 | ||
| Cisco Asr 9922 | ||
| Cisco Ncs 540-12z20g-sys-a | ||
| Cisco Ncs 540-12z20g-sys-d | ||
| Cisco Ncs 540-24z8q2c-sys | ||
| Cisco Ncs 540-28z4c-sys-a | ||
| Cisco Ncs 540-28z4c-sys-d | ||
| Cisco Ncs 540-acc-sys | ||
| Cisco Ncs 540x-12z16g-sys-a | ||
| Cisco Ncs 540x-12z16g-sys-d | ||
| Cisco Ncs 540x-16z4g8q2c-a | ||
| Cisco Ncs 540x-16z4g8q2c-d | ||
| Cisco Ncs 540x-acc-sys | ||
| Cisco Ncs 5501 | ||
| Cisco Ncs 5501-se | ||
| Cisco Ncs 5502 | ||
| Cisco Ncs 5502-se | ||
| Cisco Ncs 5508 | ||
| Cisco Ncs 5516 | ||
| Cisco Xrv 9000 | ||
| Cisco IOS XR | =5.2.5 | |
| Cisco Ncs 6000 | ||
| Cisco Ncs 6008 | ||
| Cisco IOS XR | =6.4.2 | |
| Cisco ASR 9000 | ||
| Cisco Asr 9903 | ||
| Cisco Asr 9920 | ||
| Cisco Crs-x | ||
| Cisco IOS XR | =6.6.25 | |
| Cisco Ncs 560 | ||
| Cisco IOS XR | =7.0.1 | |
| Cisco Ncs 540l | ||
| Cisco IOS XR | ||
| All of | ||
| Cisco IOS XR | =6.5.3 | |
| Any of | ||
| Cisco Asr 9000v | ||
| Cisco Asr 9001 | ||
| Cisco Asr 9006 | ||
| Cisco Asr 9010 | ||
| Cisco Asr 9901 | ||
| Cisco Asr 9904 | ||
| Cisco Asr 9906 | ||
| Cisco Asr 9910 | ||
| Cisco Asr 9912 | ||
| Cisco Asr 9922 | ||
| Cisco Ncs 540-12z20g-sys-a | ||
| Cisco Ncs 540-12z20g-sys-d | ||
| Cisco Ncs 540-24z8q2c-sys | ||
| Cisco Ncs 540-28z4c-sys-a | ||
| Cisco Ncs 540-28z4c-sys-d | ||
| Cisco Ncs 540-acc-sys | ||
| Cisco Ncs 540x-12z16g-sys-a | ||
| Cisco Ncs 540x-12z16g-sys-d | ||
| Cisco Ncs 540x-16z4g8q2c-a | ||
| Cisco Ncs 540x-16z4g8q2c-d | ||
| Cisco Ncs 540x-acc-sys | ||
| Cisco Ncs 5501 | ||
| Cisco Ncs 5501-se | ||
| Cisco Ncs 5502 | ||
| Cisco Ncs 5502-se | ||
| Cisco Ncs 5508 | ||
| Cisco Ncs 5516 | ||
| Cisco Xrv 9000 | ||
| All of | ||
| Cisco IOS XR | =5.2.5 | |
| Any of | ||
| Cisco Ncs 6000 | ||
| Cisco Ncs 6008 | ||
| All of | ||
| Cisco IOS XR | =6.4.2 | |
| Any of | ||
| Cisco ASR 9000 | ||
| Cisco Asr 9000v | ||
| Cisco Asr 9001 | ||
| Cisco Asr 9006 | ||
| Cisco Asr 9010 | ||
| Cisco Asr 9901 | ||
| Cisco Asr 9903 | ||
| Cisco Asr 9904 | ||
| Cisco Asr 9906 | ||
| Cisco Asr 9910 | ||
| Cisco Asr 9912 | ||
| Cisco Asr 9920 | ||
| Cisco Asr 9922 | ||
| Cisco Crs-x | ||
| All of | ||
| Cisco IOS XR | =6.6.25 | |
| Cisco Ncs 560 | ||
| All of | ||
| Cisco IOS XR | =7.0.1 | |
| Cisco Ncs 540l |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-3118?
CVE-2020-3118 is a vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software.
How does CVE-2020-3118 affect Cisco IOS XR Software?
CVE-2020-3118 could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device.
Which versions of Cisco IOS XR Software are affected by CVE-2020-3118?
Versions between 6.6.0 to 6.6.12 and between 7.0.0 to 7.0.2 of Cisco IOS XR Software are affected by CVE-2020-3118.
What is the severity of CVE-2020-3118?
CVE-2020-3118 has a severity rating of 8.8 (high).
How can I fix CVE-2020-3118 in Cisco IOS XR Software?
To fix CVE-2020-3118, it is recommended to update to a fixed software version as mentioned in the Cisco Security Advisory.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/description
- agent/title
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/cisco
- canonical/cisco ios xr
- version/cisco ios xr/6.6.0
- version/cisco ios xr/7.0.0
- version/cisco ios xr/6.5.3
- canonical/cisco asr 9000v
- canonical/cisco asr 9001
- canonical/cisco asr 9006
- canonical/cisco asr 9010
- canonical/cisco asr 9901
- canonical/cisco asr 9904
- canonical/cisco asr 9906
- canonical/cisco asr 9910
- canonical/cisco asr 9912
- canonical/cisco asr 9922
- canonical/cisco ncs 540-12z20g-sys-a
- canonical/cisco ncs 540-12z20g-sys-d
- canonical/cisco ncs 540-24z8q2c-sys
- canonical/cisco ncs 540-28z4c-sys-a
- canonical/cisco ncs 540-28z4c-sys-d
- canonical/cisco ncs 540-acc-sys
- canonical/cisco ncs 540x-12z16g-sys-a
- canonical/cisco ncs 540x-12z16g-sys-d
- canonical/cisco ncs 540x-16z4g8q2c-a
- canonical/cisco ncs 540x-16z4g8q2c-d
- canonical/cisco ncs 540x-acc-sys
- canonical/cisco ncs 5501
- canonical/cisco ncs 5501-se
- canonical/cisco ncs 5502
- canonical/cisco ncs 5502-se
- canonical/cisco ncs 5508
- canonical/cisco ncs 5516
- canonical/cisco xrv 9000
- version/cisco ios xr/5.2.5
- canonical/cisco ncs 6000
- canonical/cisco ncs 6008
- version/cisco ios xr/6.4.2
- canonical/cisco asr 9000
- canonical/cisco asr 9903
- canonical/cisco asr 9920
- canonical/cisco crs-x
- version/cisco ios xr/6.6.25
- canonical/cisco ncs 560
- version/cisco ios xr/7.0.1
- canonical/cisco ncs 540l