Buffer overflow in Cisco Systems, Inc products - CVE-2020-3375

Vulnerability identifier: #VU32919

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3375

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cisco IOS XE SD-WAN
Cisco SD-WAN vBond Orchestrator
Cisco SD-WAN vEdge Routers
Cisco SD-WAN vEdge Cloud Router
Catalyst SD-WAN Controller (formerly SD-WAN vSmart)
Catalyst SD-WAN Manager (formerly SD-WAN vManage)

Install updates from vendor's website.

Cisco IOS XE SD-WAN - addressed in versions 16.12.3, 17.2.1r
Cisco SD-WAN vEdge Routers - addressed in versions 18.4.5, 19.2.3, 20.1.1
Catalyst SD-WAN Controller (formerly SD-WAN vSmart) - addressed in versions 18.4.5, 19.2.3, 20.1.1
Catalyst SD-WAN Manager (formerly SD-WAN vManage) - addressed in versions 18.4.5, 19.2.3, 20.1.1
Cisco SD-WAN vEdge Cloud Router - addressed in versions 18.4.5, 19.2.3, 20.1.1
Cisco SD-WAN vBond Orchestrator - addressed in versions 18.4.5, 19.2.3, 20.1.1

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdbufof-h5f5VSeL

• Remote code execution in Cisco SD-WAN Solution Software