CVE-2020-3409 | ByteOS Network

Vulnerability Details :

CVE-2020-3409

Assigner-cisco

Assigner Org ID-d1c1063e-7a18-46af-9102-31f8928bc633

Published At-24 Sep, 2020 | 18:01

Updated At-13 Nov, 2024 | 17:55

Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability

A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:cisco

Assigner Org ID:d1c1063e-7a18-46af-9102-31f8928bc633

Published At:24 Sep, 2020 | 18:01

Updated At:13 Nov, 2024 | 17:55

▼CVE Numbering Authority (CNA)

Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability

A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.

Affected Products

Vendor

Cisco Systems, Inc.

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
CWE	CWE-20	CWE-20

Type: CWE

CWE ID: CWE-20

Description: CWE-20

Metrics

Version	Base score	Base severity	Vector
3.0	7.4	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Version: 3.0

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Exploits

The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

References

Hyperlink	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB	vendor-advisory x_refsource_CISCO

Hyperlink: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB

Resource:

vendor-advisory

x_refsource_CISCO

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB	vendor-advisory x_refsource_CISCO x_transferred

Hyperlink: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB

Resource:

vendor-advisory

x_refsource_CISCO

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:ykramarz@cisco.com

Published At:24 Sep, 2020 | 18:15

Updated At:27 Oct, 2022 | 15:47

A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.4	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Secondary	3.0	7.4	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Primary	2.0	6.1	MEDIUM	AV:A/AC:L/Au:N/C:N/I:N/A:C

Type: Primary

Version: 3.1

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Type: Secondary

Version: 3.0

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 6.1

Base severity: MEDIUM

Vector:

AV:A/AC:L/Au:N/C:N/I:N/A:C

CPE Matches

Cisco Systems, Inc.

>>ios>>15.2\(7\)e

cpe:2.3:o:cisco:ios:15.2\(7\)e:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ios_xe>>15.2\(7\)e

cpe:2.3:o:cisco:ios_xe:15.2\(7\)e:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-16gt4g-e>>-

cpe:2.3:h:cisco:ie-4000-16gt4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-16t4g-e>>-

cpe:2.3:h:cisco:ie-4000-16t4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-4gc4gp4g-e>>-

cpe:2.3:h:cisco:ie-4000-4gc4gp4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-4gs8gp4g-e>>-

cpe:2.3:h:cisco:ie-4000-4gs8gp4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-4s8p4g-e>>-

cpe:2.3:h:cisco:ie-4000-4s8p4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-4t4p4g-e>>-

cpe:2.3:h:cisco:ie-4000-4t4p4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-4tc4g-e>>-

cpe:2.3:h:cisco:ie-4000-4tc4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-8gs4g-e>>-

cpe:2.3:h:cisco:ie-4000-8gs4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-8gt4g-e>>-

cpe:2.3:h:cisco:ie-4000-8gt4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-8gt8gp4g-e>>-

cpe:2.3:h:cisco:ie-4000-8gt8gp4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-8s4g-e>>-

cpe:2.3:h:cisco:ie-4000-8s4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-4000-8t4g-e>>-

cpe:2.3:h:cisco:ie-4000-8t4g-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ios_xe>>16.11.1a

cpe:2.3:a:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ios>>16.11.1a

cpe:2.3:o:cisco:ios:16.11.1a:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3200-8p2s-e>>-

cpe:2.3:h:cisco:ie-3200-8p2s-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3200-8t2s-e>>-

cpe:2.3:h:cisco:ie-3200-8t2s-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3300-8p2s-a>>-

cpe:2.3:h:cisco:ie-3300-8p2s-a:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3300-8p2s-e>>-

cpe:2.3:h:cisco:ie-3300-8p2s-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3300-8t2s-a>>-

cpe:2.3:h:cisco:ie-3300-8t2s-a:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3300-8t2s-e>>-

cpe:2.3:h:cisco:ie-3300-8t2s-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3300-8t2x-a>>-

cpe:2.3:h:cisco:ie-3300-8t2x-a:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3300-8t2x-e>>-

cpe:2.3:h:cisco:ie-3300-8t2x-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3400-8p2s-a>>-

cpe:2.3:h:cisco:ie-3400-8p2s-a:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3400-8p2s-e>>-

cpe:2.3:h:cisco:ie-3400-8p2s-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ie-3400-8t2s-e>>-

cpe:2.3:h:cisco:ie-3400-8t2s-e:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-14t2s>>-

cpe:2.3:h:cisco:iem-3300-14t2s:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-16p>>-

cpe:2.3:h:cisco:iem-3300-16p:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-16t>>-

cpe:2.3:h:cisco:iem-3300-16t:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-6t2s>>-

cpe:2.3:h:cisco:iem-3300-6t2s:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-8p>>-

cpe:2.3:h:cisco:iem-3300-8p:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-8s>>-

cpe:2.3:h:cisco:iem-3300-8s:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3300-8t>>-

cpe:2.3:h:cisco:iem-3300-8t:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3400-8p>>-

cpe:2.3:h:cisco:iem-3400-8p:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3400-8s>>-

cpe:2.3:h:cisco:iem-3400-8s:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>iem-3400-8t>>-

cpe:2.3:h:cisco:iem-3400-8t:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-400	Primary	nvd@nist.gov
CWE-20	Secondary	ykramarz@cisco.com

CWE ID: CWE-400

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-20

Type: Secondary

Source: ykramarz@cisco.com

References

Hyperlink	Source	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB	ykramarz@cisco.com	Vendor Advisory

Hyperlink: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB

Source: ykramarz@cisco.com

Resource:

Vendor Advisory