SB2020022712 - Authentication Bypass in Cisco NX-OS Software 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020022712

SB2020022712 - Authentication Bypass in Cisco NX-OS Software

Published: February 27, 2020

Security Bulletin ID SB2020022712
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Use of hard-coded credentials (CVE-ID: CVE-2020-3165)

The vulnerability allows a remote attacker to bypass MD5 authentication and establish a BGP connection with the device.

The vulnerability exists when the Border Gateway Protocol (BGP) Message Digest 5 (MD5) authentication is bypassed if the peer does not have MD5 authentication configured, the NX-OS device does have BGP MD5 authentication configured, and the NX-OS BGP virtual routing and forwarding (VRF) name is configured to be greater than 19 characters. A remote unauthenticated attacker can establish a BGP session with the NX-OS device without MD5 authentication.


Remediation

Install update from vendor's website.

References