SB2020060512 - Insufficient verification of data authenticity in Cisco IOS XE Software

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020060512

SB2020060512 - Insufficient verification of data authenticity in Cisco IOS XE Software

Published: June 5, 2020

Security Bulletin ID SB2020060512
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insufficient verification of data authenticity (CVE-ID: CVE-2020-3220)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disconnect legitimate IPsec VPN sessions to an affected device.

The vulnerability exists due to insufficient verification of authenticity of received Encapsulating Security Payload (ESP) packets. A remote attacker can tamper with ESP cleartext values as a man-in-the-middle and disconnect legitimate IPsec VPN sessions to an affected device.

This vulnerability affects the following products if they are running affected release of Cisco IOS XE Software: 

  • Cisco ASR 1000 Series Aggregation Services Routers 
  • Cisco Cloud Services Router 1000V Series 
  • Cisco 4000 Series Integrated Services Routers 
  • Cisco 1000 Series Integrated Services Routers


Remediation

Install update from vendor's website.

References