Lucene search

CiscoCVE-2020-3206

HistoryJun 03, 2020 - 6:15 p.m.

CVE-2020-3206

2020-06-0318:15:18

CWE-20

cisco

web.nvd.nist.gov

cve-2020-3206

vulnerability

cisco

catalyst 9800

wireless controllers

cisco ios xe

pmf

802.11w

nvd

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

CVSS3

4.7

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

25.0%

JSON

A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to terminate a valid user connection to an affected device. The vulnerability exists because the affected software does not properly validate 802.11w disassociation and deauthentication PMFs that it receives. An attacker could exploit this vulnerability by sending a spoofed 802.11w PMF from a valid, authenticated client on a network adjacent to an affected device. A successful exploit could allow the attacker to terminate a single valid user connection to the affected device.

Affected configurations

Nvd

Node

ciscoios_xeMatch16.10.1

ciscoios_xeMatch16.10.1e

ciscoios_xeMatch16.10.1s

VendorProductVersionCPE
ciscoios_xe16.10.1cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*
ciscoios_xe16.10.1ecpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*
ciscoios_xe16.10.1scpe:2.3:o:cisco:ios_xe:16.10.1s:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	16.10.1	cpe:2.3:o:cisco:ios_xe:16.10.1:::::::*
cisco	ios_xe	16.10.1e	cpe:2.3:o:cisco:ios_xe:16.10.1e:::::::*
cisco	ios_xe	16.10.1s	cpe:2.3:o:cisco:ios_xe:16.10.1s:::::::*

CNA Affected

[
  {
    "product": "Cisco IOS XE Software 16.10.1",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-dos-AnvKvMxR

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

CVSS3

4.7

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

25.0%

JSON

Related for CVE-2020-3206