SB2020012707 - Input validation error in Cisco Application Policy Infrastructure Controller
Published: January 27, 2020
Security Bulletin ID
SB2020012707
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2020-3139)
The vulnerability allows a remote attacker to bypass configured deny entries for specific IP ports.
The vulnerability exists in the out of band (OOB) management interface due to the configuration of specific IP table entries for which there is a programming logic error that results in the IP port being permitted. A remote attacker can send traffic to the OOB management interface and bypass configured IP table rules to drop specific IP port traffic. The attacker has no control over the configuration of the device itself.
Remediation
Install update from vendor's website.