State Issues in Cisco IOS and Cisco IOS XE - CVE-2020-3200

Vulnerability identifier: #VU68873

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-3200

CWE-ID: CWE-371

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perofrm a denial of service (DoS) attack.

The vulnerability exists due to an internal state not being represented correctly in the Secure Shell (SSH) server. A remote user can create an SSH connection to an affected device and cause a denial of service condition.

Cisco IOS
Cisco IOS XE
Allen-Bradley Stratix 5410 Industrial Distribution Switches
Allen-Bradley Stratix 5400 Industrial Ethernet Switches

Install updates from vendor's website.

Cisco IOS - addressed in versions ap-16.12.4.9, ap-16.12.4a, ap-17.1.1.30, ap-17.1.1t, ap-17.2.0.78, ap-17.2.1.4, ap-17.2.1, ap-17.3.0.42, ap-17.3.1, 008.005(161.102), 008.005(162.107), 008.005(164.000), 008.005(164.008), 8.5.171.0, 008.008(128.041), 008.008(130.000), 008.010(105.146), 008.010(112.102), 008.010(113.000), 008.010(118.084), 008.010(121.000), 008.010(128.055), 008.010(130.000), 15.0(02)SE13a, 15.1(2)SY16, 15.1(2)SY17, 15.2(2)E10a, 15.2(04)E10, 15.2(7b)E00b, 15.2(7)E2, 15.2(7)E3, 15.2(7)E4, 15.2(07.00.59i)E2, 15.2(07.00.87i)E2, 15.2(07.01.03s)E1, 15.2(07.01.62k)E1, 15.2(07.01.78i)E3, 15.2(07.02.00l)E4, 15.2(8)E, 15.3(03)JF12i, 15.3.3 JF14, 15.3(03)JI06, 15.3(03)JK01t, 15.3(03)JK02, 15.3(03)JK02a, 15.3(03)JK05, 15.3(03)JPI06a, 15.3(03)JPJ02t, 15.3(03)JPJ03, 15.3(03)JPJ06, 15.5(1)IA001.1211, 15.5(1)SY5, 15.5(1)SY6, 15.5(01.01.10)SY04, 15.5(3)M11, 15.5(3)S10a, 15.6(02)SP08, 15.6(02.01)SP09, 15.6(03)M08, 15.7(03)M06, 15.7(03.00q)M05, 15.8(03.00d)M03, 15.8(03)M04, 15.8(03.01s)M01, 15.9(3)M1, 16.3.10, 16.3.11, 16.6(6.82), 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.6.10, 16.9(3.60), 16.9.4, 16.9.5, 16.9.6, 16.9.7, 16.9.8, 16.10.3, 16.12(0.141), 16.12.1, 16.12.1c, 16.12.1d, 16.12.1e, 16.12.1s, 16.12.1t, 16.12.1w, 16.12.1x, 16.12.1y, 16.12.1z, 16.12.1z1, 16.12.1z2, 16.12.1a, 16.12.1b, 16.12(1.2), 16.12.2, 16.12.2s, 16.12.2t, 16.12.2a, 16.12.3, 16.12.3s, 16.12.3a, 16.12.4, 16.12.4a, 16.12.5, 16.12.5a, 16.12.5 b, 16.12.6, 16.12.6a, 16.12.7, 17.1(0.35), 17.1.1, 17.1.1s, 17.1.1t, 17.1.1a, 17.1.2, 17.1.3, 17.2.1, 17.2.1v, 17.2.1a, 17.2.1r, 17.2.2, 17.2.3, 17.3.1, 17.3.1w, 17.3.1x, 17.3.1z, 17.3.1a, 17.3.2, 17.3.2a, 17.3.3, 17.3.4, 17.3.4c, 17.3.4a, 17.3.4b, 17.3.5, 17.3.5a, 17.4.1, 17.4.1a, 17.4.1b, 17.4.2, 17.5.1, 17.5.1a, 17.6.1, 17.6.1w, 17.6.1x, 17.6.1y, 17.6.1a, 17.6.2, 17.6.3, 17.6.3a, 17.7.1, 17.7.1a
Cisco IOS XE - addressed in versions Amsterdam 17.1.1, Amsterdam-17.1.1t, Amsterdam 17.2.1, Amsterdam 17.3.1, ap-16.12.4.9, ap-16.12.4a, ap-17.1.1.30, ap-17.1.1t, ap-17.2.0.78, ap-17.2.1.4, ap-17.2.1, ap-17.3.0.42, ap-17.3.1, Everest-16.6.7, Fuji-16.9.4, Gibraltar 16.12.1, Gibraltar 16.12.1b, Gibraltar 16.12.1c, Gibraltar 16.12.1d, Gibraltar 16.12.1e, Gibraltar 16.12.1s, Gibraltar-16.12.4a, 008.005(161.102), 008.005(162.107), 008.005(164.000), 008.005(164.008), 008.005(171.000), 008.008(128.041), 008.008(130.000), 008.010(105.146), 008.010(112.102), 008.010(113.000), 008.010(118.084), 008.010(121.000), 008.010(128.055), 008.010(130.000), 15.0(02)SE13a, 15.1(02)SY15.17, 15.1(02)SY16, 15.2(02)E10a, 15.2(04)E10, 15.2(07b)E00b, 15.2(07)E02, 15.2(07)E03, 15.2(07)E04, 15.2(07.00.59i)E02, 15.2(07.00.87i)E02, 15.2(07.01.03s)E01, 15.2(07.01.62k)E01, 15.2(07.01.78i)E03, 15.2(07.02.00l)E04, 15.2(08)E, 15.3(03)JF12i, 15.3(03)JF14, 15.3(03)JI06, 15.3(03)JK01t, 15.3(03)JK02, 15.3(03)JK02a, 15.3(03)JK05, 15.3(03)JPI06a, 15.3(03)JPJ02t, 15.3(03)JPJ03, 15.3(03)JPJ06, 15.5(01)IA001.1211, 15.5(01)SY05, 15.5(01)SY06, 15.5(01.01.10)SY04, 15.5(03)M11, 15.5(03)S10a, 15.6(02)SP08, 15.6(02.01)SP09, 15.6(03)M08, 15.7(03)M06, 15.7(03.00q)M05, 15.8(03.00d)M03, 15.8(03)M04, 15.8(03.01s)M01, 15.9(03)M01, 16.3.10, 16.3.11, 16.6(6.82), 16.6.7, 16.6.7a, 16.6.8, 16.6.9, 16.6.10, 16.9(3.60), 16.9.4, 16.9.5, 16.9.6, 16.9.7, 16.9.8, 16.10.3, 16.12(0.141), 16.12.1, 16.12.1c, 16.12.1d, 16.12.1e, 16.12.1s, 16.12.1t, 16.12.1w, 16.12.1x, 16.12.1y, 16.12.1z, 16.12.1z1, 16.12.1z2, 16.12.1a, 16.12.1b, 16.12(1.2), 16.12.2, 16.12.2s, 16.12.2t, 16.12.2a, 16.12.3, 16.12.3s, 16.12.3a, 16.12.4, 16.12.4a, 16.12.5, 16.12.5a, 16.12.5 b, 16.12.6, 16.12.6a, 16.12.7, 17.1(0.35), 17.1.1, 17.1.1s, 17.1.1t, 17.1.1a, 17.1.2, 17.1.3, 17.2.1, 17.2.1v, 17.2.1a, 17.2.1r, 17.2.2, 17.2.3, 17.3.1, 17.3.1w, 17.3.1x, 17.3.1z, 17.3.1a, 17.3.2, 17.3.2a, 17.3.3, 17.3.4, 17.3.4c, 17.3.4a, 17.3.4 b, 17.3.5, 17.3.5a, 17.4.1, 17.4.1a, 17.4.1b, 17.4.2, 17.5.1, 17.5.1a, 17.6.1, 17.6.1w, 17.6.1x, 17.6.1y, 17.6.1a, 17.6.2, 17.6.3, 17.6.3a, 17.7.1, 17.7.1a
Allen-Bradley Stratix 5410 Industrial Distribution Switches - update to 15.2(7)E2
Allen-Bradley Stratix 5400 Industrial Ethernet Switches - update to 15.2(7)E2

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssh-dos-Un22sd2A

• Denial of service in Cisco IOS and Cisco IOS XE
• Denial of service in Rockwell Automation Stratix Devices Containing Cisco IOS