CVE-2020-3353 Cisco Identity Services Engine Denial of Service Vulnerability

Medium 5.9 Published 3 Jun 2020 Updated 15 Nov 2024

Unauthenticated remote attackers can cause a denial of service by exploiting a race condition in the syslog processing engine of Cisco ISE.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3353?

CVE-2020-3353 is a medium-severity vulnerability in Cisco Identity Services Engine, published on 3 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the syslog processing engine of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a race condition that may occur when syslog messages are processed. An attacker could exploit this vulnerability by sending a high rate of syslog messages to an affected device. A successful exploit could allow the attacker to cause the Application Server process to crash, resulting in a DoS condition.

Weakness: CWE-362

Which versions are affected by CVE-2020-3353?

It affects 1 product.

Products include Cisco Identity Services Engine.

How do I fix CVE-2020-3353?

No fix has been published for CVE-2020-3353 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3353 being exploited?

There is no known exploitation of CVE-2020-3353 in the wild and no public exploit code.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-vrjw-2w56-8m6q.