CVE-2020-3206
Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to terminate a valid user connection to an affected device. The vulnerability exists because the affected software does not properly validate 802.11w disassociation and deauthentication PMFs that it receives. An attacker could exploit this vulnerability by sending a spoofed 802.11w PMF from a valid, authenticated client on a network adjacent to an affected device. A successful exploit could allow the attacker to terminate a single valid user connection to the affected device.
Una vulnerabilidad en el manejo de IEEE 802.11w Protected Management Frames (PMFs) de Cisco Catalyst 9800 Series Wireless Controllers que son ejecutados en el Cisco IOS XE Software, podría permitir a un atacante adyacente no autenticado finalizar una conexión de usuario válida en un dispositivo afectado. La vulnerabilidad se presenta porque el software afectado no comprueba apropiadamente los PMF de disociación y desautenticación de 802.11w que los recibe. Un atacante podría explotar esta vulnerabilidad mediante el envío de un PMF 802.11w falsificado desde un cliente autenticado válido en una red adyacente hacia un dispositivo afectado. Una explotación con éxito podría permitir al atacante terminar una conexión de usuario válida única en el dispositivo afectado.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-12 CVE Reserved
- 2020-06-03 CVE Published
- 2023-03-08 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-dos-AnvKvMxR | 2021-09-17 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 16.10.1 Search vendor "Cisco" for product "Ios Xe" and version "16.10.1" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 16.10.1e Search vendor "Cisco" for product "Ios Xe" and version "16.10.1e" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | 16.10.1s Search vendor "Cisco" for product "Ios Xe" and version "16.10.1s" | - |
Affected
|