Resource exhaustion in Cisco Catalyst 9800-40
CVE-2020-3203
A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain public key infrastructure (PKI) packets. An attacker could exploit this vulnerability by sending crafted Secure Sockets Layer (SSL) packets to an affected device. A successful exploit could cause an affected device to continuously consume memory, which could result in a memory allocation failure that leads to a crash and causes a DoS condition.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.008 (54.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Cisco Catalyst_9800-40
- Cisco Catalyst_9800-80
- Cisco Catalyst_9800-cl
- Cisco Catalyst_9800-l
- Cisco Catalyst_9800-l-c
- Cisco Catalyst_9800-l-f
- Cisco Ios Xe Software 16.1.1 — versions n/a
- Cisco Ios_xe — versions 16.1.1, 16.1.2, 16.1.3
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-3203?
- CVE-2020-3203 is a high-severity vulnerability in Cisco Catalyst 9800-40, classified under Uncontrolled Resource Consumption. CVSS score: 8.6/10. Published 2020-06-03.
- How severe is CVE-2020-3203?
- High severity. CVSS v3 base score is 8.6 out of 10.