CVE-2020-3231 Auth bypass in Cisco IOS 15.2(5a)E

Medium 4.7 Published 3 Jun 2020 Updated 15 Nov 2024

An unauthenticated adjacent attacker can bypass 802.1X authentication to send and receive broadcast traffic on Cisco Catalyst switches.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3231?

CVE-2020-3231 is a medium-severity authentication bypass vulnerability in Cisco Ios, published on 3 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the 802.1X feature of Cisco Catalyst 2960-L Series Switches and Cisco Catalyst CDB-8P Switches could allow an unauthenticated, adjacent attacker to forward broadcast traffic before being authenticated on the port. The vulnerability exists because broadcast traffic that is received on the 802.1X-enabled port is mishandled. An attacker could exploit this vulnerability by sending broadcast traffic on the port before being authenticated. A successful exploit could allow the attacker to send and receive broadcast traffic on the 802.1X-enabled port before authentication.

Weakness: CWE-863, CWE-284

Which versions are affected by CVE-2020-3231?

It affects 1 product.

Products include Cisco Ios.

How do I fix CVE-2020-3231?

No fix has been published for CVE-2020-3231 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-3231 being exploited?

There is no known exploitation of CVE-2020-3231 in the wild and no public exploit code.

All Cisco Ios vulnerabilities

Sources

Also known as GHSA-q4w2-p3xv-w8vf.