CERT/CC Vulnerability Note VU#261385

Overview

Cisco Discovery Protocol (CDP) is a proprietary layer-2 networking protocol that Cisco devices use to gather information about devices connected to the network. Armis Security found that CDP supported devices are vulnerable to heap overflow in Cisco IP Cameras (CVE-2020-3110), stack overflow in Cisco VoIP devices (CVE-2020-3111), a format string stack overflow vulnerability (CVE-2020-3118), stack overflow and arbitrary write (CVE-2020-3119), and a resource exhaustion denial-of-service vulnerability (CVE-2020-3120) in Cisco NX-OS switches and Cisco IOS XR Routers, among others. These vulnerabilities could allow an attacker on the local network to execute code or cause a denial of service.

Description

CVE-2020-3110

Cisco's Video Surveillance 8000 Series IP cameras with CDP enabled are vulnerable to a heap overflow in the parsing of DeviceID type-length-value (TLV). The CVSS score reflected below is in regards to this vulnerability.

CVE-2020-3111
Cisco Voice over Internet Protocol (VoIP) phones with CDP enabled are vulnerable to a stack overflow in the parsing of PortID type-length-value (TLV).

CVE-2020-3118
Cisco's CDP subsystem of devices running, or based on, Cisco IOS XR Software are vulnerable to improper validation of string input from certain fields within a CDP message that could lead to a stack overflow.

CVE-2020-3119
Cisco's CDP subsystem of devices running, or based on, Cisco NX-OS Software is vulnerable to a stack buffer overflow and arbitrary write in the parsing of Power over Ethernet (PoE) type-length-value (TLV).

CVE-2020-3120
Cisco's CDP subsystem of devices running, or based on, Cisco NX-OS, IOS XR, and FXOS Software are vulnerable to a resource exhaustion denial-of-service condition.

Impact

CVE-2020-3110 and CVE-2020-3111, CVE-2020-3118, CVE-2020-3119
These vulnerabilities could allow a remote attacker on the local network to cause a denial of service by rebooting the affected device running CDP. A remote attacker could also execute code by sending a malicious unauthenticated CDP packet to the affected device.

CVE-2020-3120
This vulnerability could allow a remote attacker on the local network to cause a denial of service by rebooting the affected device running CDP.

These vulnerabilities affect devices that have CDP enabled. It is important to note that for all affected devices, CDP is enabled by default. A complete list of the affected products can be found in the following Cisco advisories:

CVE-2020-3110 affected products can be found here.
CVE-2020-3111 affected products can be found here.
CVE-2020-3118 affected products can be found here.
CVE-2020-3119 affected products can be found here.
CVE-2020-3120 affected products can be found here.

Solution

Apply an update
Please refer to Cisco's advisories and support site for specific device updates.

Acknowledgements

Thanks to Ben Seri of Armis Security for reporting this vulnerability.

This document was written by Madison Oliver.

Vendor Information

261385

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

Cisco Affected

Updated: 2020-07-08

CVE-2020-3110

Affected

CVE-2020-3111

Affected

CVE-2020-3118

Affected

CVE-2020-3119

Affected

CVE-2020-3120

Affected

Vendor Statement

We have not received a statement from the vendor.

We do not support Cisco Discovery Protocol on any of our devices and hence not affected by these issues.

Pulse Secure Not Affected

Notified: 2020-02-05 Updated: 2020-07-08

Statement Date: February 05, 2020

CVE-2020-3110

Not Affected

CVE-2020-3111

Not Affected

CVE-2020-3118

Not Affected

CVE-2020-3119

Not Affected

CVE-2020-3120

Not Affected

Vendor Statement

Pulse Secure Products are not vulnerable to these vulnerabilities.

Technicolor Not Affected

Notified: 2020-07-02 Updated: 2020-07-08

CVSS Metrics

Group	Score	Vector
Base	8.3	AV:A/AC:L/Au:N/C:C/I:C/A:C
Temporal	8.3	E:ND/RL:ND/RC:ND
Environmental	8.3	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Other Information

CVE IDs:	CVE-2020-3110 CVE-2020-3111 CVE-2020-3118 CVE-2020-3119 CVE-2020-3120
Date Public:	2020-02-05
Date First Published:	2020-02-05
Date Last Updated:	2020-07-08 16:55 UTC
Document Revision:	73

Software Engineering Institute

CERT Coordination Center

Cisco Discovery Protocol (CDP) enabled devices are vulnerable to denial-of-service and remote code execution

Vulnerability Note VU#261385

Overview

Description

Impact

Solution

Acknowledgements

Vendor Information

Cisco Affected

Vendor Statement

References

Arista Networks Inc. Not Affected

Vendor Statement

Belden Not Affected

Vendor Statement

D-Link Systems Inc. Not Affected

Vendor Statement

FreeBSD Project Not Affected

Vendor Statement

LANCOM Systems GmbH Not Affected

Vendor Statement

Palo Alto Networks Not Affected

Vendor Statement

Pulse Secure Not Affected

Vendor Statement

Technicolor Not Affected

Vendor Statement

A10 Networks Unknown

Vendor Statement

ACCESS Unknown

Vendor Statement

ADTRAN Unknown

Vendor Statement

ANTlabs Unknown

Vendor Statement

ARRIS Unknown

Vendor Statement

ASUSTeK Computer Inc. Unknown

Vendor Statement

AT&T Unknown

Vendor Statement

AVM GmbH Unknown

Vendor Statement

Actelis Networks Unknown

Vendor Statement

Actiontec Unknown

Vendor Statement

Aerohive Unknown

Vendor Statement

AhnLab Inc Unknown

Vendor Statement

AirWatch Unknown

Vendor Statement

Akamai Technologies Inc. Unknown

Vendor Statement

Alcatel-Lucent Enterprise Unknown

Vendor Statement

Allied Telesis Unknown

Vendor Statement

Alpine Linux Unknown

Vendor Statement

Amazon Unknown

Vendor Statement

Android Open Source Project Unknown

Vendor Statement

Apple Unknown

Vendor Statement

Arch Linux Unknown

Vendor Statement

Armis Unknown

Vendor Statement

Aruba Networks Unknown

Vendor Statement

Aspera Inc. Unknown

Vendor Statement

Atheros Communications Inc Unknown

Vendor Statement

Avaya Inc. Unknown