#VU25028 Format string error in Cisco Systems, Inc Hardware solutions


Published: 2020-02-07 | Updated: 2022-02-20

Vulnerability identifier: #VU25028

Vulnerability risk: Low

CVSSv3.1: 8.4 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2020-3118

CWE-ID: CWE-134

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Cisco ASR 9000 Series Aggregation Services Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco IOS XRv 9000 Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5000 Series
Hardware solutions / Routers & switches, VoIP, GSM, etc
Network Convergence System 5500 Series
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 540 Series Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 560 Series Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 6000 Series Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Carrier Routing System
Hardware solutions / Firmware
Cisco Network Convergence System 1000 Series
Hardware solutions / Firmware

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper validation of string input from certain fields in the Cisco Discovery Protocol implementation for Cisco IOS XR Software. A remote attacker on the local network can supply a specially crafted input that contains format string specifiers, cause a stack overflow and execute arbitrary code with administrative privileges on an affected device.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Cisco IOS XR Software Release
First Fixed Release for This Vulnerability
Earlier than 6.6
Appropriate SMU
6.61
6.6.3 or appropriate SMU
7.0
7.0.2 (Mar 2020) or appropriate SMU
7.1

Not vulnerable

The following SMUs are also available for Cisco IOS XR Software:
Cisco IOS XR Software Release
PlatformSMU Name
 5.2.5 NCS6K ncs6k-5.2.5.CSCvr78185
 6.4.2 ASR9K-PX asr9k-px-6.4.2.CSCvr78185
 CRS-PX hfr-px-6.4.2.CSCvr78185
 6.5.3 ASR9K-PX asr9k-px-6.5.3.CSCvr78185
 ASR9K-X64 asr9k-x64-6.5.3.CSCvr78185
 NCS540 ncs540-6.5.3.CSCvr78185
 NCS5K ncs5k-6.5.3.CSCvr78185
 NCS5500 ncs5500-6.5.3.CSCvr78185
 XRV9K xrv9k-6.5.3.CSCvr78185
 6.6.12 White box iosxrwbd-6.6.12.CSCvr78185
 6.6.25 NCS560 ncs560-6.6.25.CSCvr78185
 7.0.1 NCS540L ncs540l-7.0.1.CSCvr78185

Vulnerable software versions

Cisco ASR 9000 Series Aggregation Services Routers: 6.6 - 7.0

Cisco Carrier Routing System: 6.6 - 7.0

Cisco IOS XRv 9000 Router: 6.6 - 7.0

Cisco Network Convergence System 5000 Series: 6.6 - 7.0

Network Convergence System 5500 Series: 6.6 - 7.0

Cisco Network Convergence System 1000 Series: 6.6

Cisco Network Convergence System 540 Series Routers: 6.6 - 7.0

Cisco Network Convergence System 560 Series Routers: 6.6 - 7.0

Cisco Network Convergence System 6000 Series Routers: 6.6 - 7.0

External links
http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.


Latest bulletins with this vulnerability


Format string error in Cisco Discovery Protocol for Cisco IOS XR