CVE-2020-3500: cisco cisco asr 5000 series software

Vulnerability summary

CVE-2020-3500 is a high (CVSS 8.6) vulnerability in cisco cisco asr 5000 series software. EPSS estimates a 1.62% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities.

Timeline

1. 17-08-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the IPv6 implementation of Cisco StarOS could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of incoming IPv6 traffic. An attacker could exploit this vulnerability by sending a crafted IPv6 packet to an affected device with the goal of reaching the vulnerable section of the input buffer. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is specific to IPv6 traffic. IPv4 traffic is not affected.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.