Details of VAR-202006-1102

ID

VAR-202006-1102

CVE

CVE-2020-3235

TITLE

Cisco IOS and IOS XE Input verification vulnerabilities in software

Trust: 0.8

sources: JVNDB: JVNDB-2020-006129

DESCRIPTION

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient input validation when the software processes specific SNMP object identifiers. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: To exploit this vulnerability by using SNMPv2c or earlier, the attacker must know the SNMP read-only community string for an affected system. To exploit this vulnerability by using SNMPv3, the attacker must know the user credentials for the affected system

Trust: 1.71

sources: NVD: CVE-2020-3235 // JVNDB: JVNDB-2020-006129 // VULMON: CVE-2020-3235

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.2e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.5sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(1\)sg2	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.0sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.1sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.4e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.9.2be	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.5e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e2	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e8	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e8	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.2sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.5ae	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg3	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e5b	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.0sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.6sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(54\)sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.1sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg10	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.9.2e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e7b	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.2sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg1	Trust: 1.0
vendor:	oracle	model:	goldengate management pack	scope:	eq	version:	12.2.1.2.0	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.10.1se	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e5	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.6sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(1\)e1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.2xo	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg8	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.6e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.8sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg7	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e9a	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.10.1e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.4e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2b\)e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(1\)ey	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(1\)xo1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e5a	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)ex8	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(1\)sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.1xo	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.4sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.8e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.2sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.1e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e4	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(52\)sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.0xo	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.9.0e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg4	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg9	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg10	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e4	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e3	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.5e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.3sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.7e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.0e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.7e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg6	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.9.1e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e7	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg3	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.7sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.1e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e7	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)ex2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.0be	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg6	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.8sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.5be	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.3e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg8	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(1\)e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e4	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg9	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.5sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.10.1ae	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(54\)sg1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.1e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.1e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.0e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.3e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.10.0e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg11	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e6	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e6	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.9sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(54\)wo	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(1\)xo	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e5a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.3e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg7	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.2e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)jpj	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.10.2e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg11	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(1\)sg1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.10.0ce	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg8	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.4sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.9e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)sg2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.11sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg5	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e9	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)xo	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.7sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.0e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(53\)sg6	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.8e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(4\)e3	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.1sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e10	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.3e	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.5ae	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.0e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(1\)e3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.10sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.6e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(2\)sg7	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.10e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(1\)ey2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.3sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.2e	Trust: 1.0
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-006129 // NVD: CVE-2020-3235

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2020-3235
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-006129
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202006-369
value:	HIGH
Trust: 0.6
VULMON:	CVE-2020-3235
value:	MEDIUM
Trust: 0.1

VULMON:	CVE-2020-3235
severity:	MEDIUM
baseScore:	6.3
vectorString:	AV:N/AC:M/AU:S/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.8
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2020-006129
severity:	MEDIUM
baseScore:	6.3
vectorString:	AV:N/AC:M/AU:S/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

NVD:	CVE-2020-3235
baseSeverity:	HIGH
baseScore:	7.7
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	4.0
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-006129
baseSeverity:	HIGH
baseScore:	7.7
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2020-3235 // JVNDB: JVNDB-2020-006129 // CNNVD: CNNVD-202006-369 // NVD: CVE-2020-3235

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2020-006129 // NVD: CVE-2020-3235

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-369

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202006-369

CONFIGURATIONS

sources: NVD: CVE-2020-3235

PATCH

title:	cisco-sa-snmp-dos-USxSyTk5	url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-snmp-dos-usxsytk5	Trust: 0.8
title:	Cisco IOS and IOS XE Fixes for code issue vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=121145	Trust: 0.6
title:	Cisco: Cisco IOS and IOS XE Software Simple Network Management Protocol Denial of Service Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-snmp-dos-usxsytk5	Trust: 0.1
title:	CVE-2020-3235	url:	https://github.com/alaial90/cve-2020-3235	Trust: 0.1

sources: VULMON: CVE-2020-3235 // JVNDB: JVNDB-2020-006129 // CNNVD: CNNVD-202006-369

EXTERNAL IDS

db:	NVD	id:	CVE-2020-3235	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-006129	Trust: 0.8
db:	CNNVD	id:	CNNVD-202006-369	Trust: 0.6
db:	VULMON	id:	CVE-2020-3235	Trust: 0.1

sources: VULMON: CVE-2020-3235 // JVNDB: JVNDB-2020-006129 // CNNVD: CNNVD-202006-369 // NVD: CVE-2020-3235

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-snmp-dos-usxsytk5	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-3235	Trust: 1.4
url:	https://www.oracle.com/security-alerts/cpuoct2020.html	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3235	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-ios-ios-xe-denial-of-service-via-snmp-32424	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/20.html	Trust: 0.1
url:	https://github.com/alaial90/cve-2020-3235	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-3235 // JVNDB: JVNDB-2020-006129 // CNNVD: CNNVD-202006-369 // NVD: CVE-2020-3235

SOURCES

db:	VULMON	id:	CVE-2020-3235
db:	JVNDB	id:	JVNDB-2020-006129
db:	CNNVD	id:	CNNVD-202006-369
db:	NVD	id:	CVE-2020-3235

LAST UPDATE DATE

2022-05-04T09:02:37.346000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2020-3235	date:	2021-09-17T00:00:00
db:	JVNDB	id:	JVNDB-2020-006129	date:	2020-07-01T00:00:00
db:	CNNVD	id:	CNNVD-202006-369	date:	2020-06-11T00:00:00
db:	NVD	id:	CVE-2020-3235	date:	2021-09-17T18:49:00

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2020-3235	date:	2020-06-03T00:00:00
db:	JVNDB	id:	JVNDB-2020-006129	date:	2020-07-01T00:00:00
db:	CNNVD	id:	CNNVD-202006-369	date:	2020-06-03T00:00:00
db:	NVD	id:	CVE-2020-3235	date:	2020-06-03T18:15:00