CVE-2020-3429

A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect packet processing during the WPA2 and WPA3 authentication handshake when configured for dot1x or pre-shared key (PSK) authentication key management (AKM) with 802.11r BSS Fast Transition (FT) enabled. An attacker could exploit this vulnerability by sending a crafted authentication packet to an affected device. A successful exploit could cause an affected device to reload, resulting in a DoS condition.

CVSS v3 6.5 MEDIUM
CVSS v2.0 5.7 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.7^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:M/Au:N/C:N/I:N/A:C

Exploitability : 5.5 / Impact : 6.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wpa-dos-cXshjerc	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:catalyst_9300:-:::::::*
	cpe:2.3:h:cisco:catalyst_9400:-:::::::*
	cpe:2.3:h:cisco:catalyst_9500:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-40:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-80:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-cl:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-l:-:::::::*

History

No history.

Information

Published : 2020-09-24 18:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-3429

Mitre link : CVE-2020-3429

CVE.ORG link : CVE-2020-3429

JSON object : View

Products Affected

cisco

catalyst_9500
catalyst_9800-l
ios_xe
catalyst_9800-40
catalyst_9800-80
catalyst_9400
catalyst_9800-cl
catalyst_9300

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2020-3429", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-09-24T18:15:19.463", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wpa-dos-cXshjerc", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect packet processing during the WPA2 and WPA3 authentication handshake when configured for dot1x or pre-shared key (PSK) authentication key management (AKM) with 802.11r BSS Fast Transition (FT) enabled. An attacker could exploit this vulnerability by sending a crafted authentication packet to an affected device. A successful exploit could cause an affected device to reload, resulting in a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en la implementaci\u00f3n de seguridad WPA2 y WPA3 de Cisco IOS XE Wireless Controller Software para Cisco Catalyst 9000 Family, podr\u00eda permitir a un atacante adyacente no autenticado causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. La vulnerabilidad es debido al procesamiento incorrecto de paquetes durante el protocolo de enlace de autenticaci\u00f3n WPA2 y WPA3 cuando se configura para la administraci\u00f3n de claves de autenticaci\u00f3n (AKM) dot1x o de clave precompartida (PSK) con 802.11r BSS Fast Transition (FT) habilitado. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de un paquete de autenticaci\u00f3n dise\u00f1ado hacia un dispositivo afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda hacer que un dispositivo afectado se recargue, resultando en una condici\u00f3n DoS."}], "lastModified": "2021-08-06T19:03:16.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9027A528-2588-4C06-810B-5BB313FE4323"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0972076B-5C87-44B3-90EC-4C200B89318A"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "737F22AB-C5A9-4A18-BA3D-38A222491397"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "176ACF88-6112-4179-8492-50C50577B300"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B9ED0E5-CB20-4106-9CF2-8EB587B33543"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2B0E620C-8E09-4F7C-A326-26013173B993"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF93F1C8-669F-4ECB-8D81-ECDA7B550175"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E0BA345-B7D7-4975-9199-4DC7875BBFD0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}