Data Handling in Cisco Systems, Inc products - CVE-2020-10136

Vulnerability identifier: #VU28558

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10136

CWE-ID: CWE-19

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected device unexpectedly decapsulating and processing IP in IP packets that are destined to a locally configured IP address. A remote attacker can send a specially crafted IP in IP packet and cause a denial of service condition on the target device.

Cisco NX-OS
UCS 6300 Series Fabric Interconnects
UCS 6200 Series Fabric Interconnects
Cisco Nexus 3000 Series Switches
Cisco Nexus 9000 Series Switches NX-OS Mode
Nexus 1000V Switch for Microsoft Hyper-V
Nexus 1000V Switch for VMware vSphere
Cisco Nexus 7000 Series Switches
Nexus 5600 Platform Switches
Cisco Nexus 6000 Series Switches
Nexus 5500 Platform Switches
Nexus 1000 Virtual Edge for VMware vSphere

Install updates from vendor's website.

Cisco Nexus 3000 Series Switches - addressed in versions 6.0.2 U5.1, 7.0.3 I2.1
Cisco Nexus 9000 Series Switches NX-OS Mode - addressed in versions 6.0.2 U5.1, 7.0.3 I2.1
Cisco Nexus 7000 Series Switches - addressed in versions 6.2.24a S1, 6.2.24.2 S0, 7.3.6 SMU.1.2
Nexus 5600 Platform Switches - addressed in versions 7.3.7 N1.1b, 7.3.8 N1.0.793, 7.3.8 N1.1
Cisco Nexus 6000 Series Switches - addressed in versions 7.3.7 N1.1b, 7.3.8 N1.0.793, 7.3.8 N1.1
Nexus 5500 Platform Switches - addressed in versions 7.3.7 N1.1b, 7.3.8 N1.0.793, 7.3.8 N1.1

• https://kb.cert.org/vuls/id/636397/
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4
• https://www.digi.com/resources/security

• Denial of service in Cisco NX-OS Software