CVE-2020-3567 Cisco Industrial Network Director Denial of Service Vulnerability
Authenticated attackers can cause permanent denial of service on Cisco Industrial Network Director via crafted REST API requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3567?
CVE-2020-3567 is a medium-severity denial of service vulnerability in Cisco Industrial Network Director, published on 8 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remote attacker to cause the CPU utilization to increase to 100 percent, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of requests sent to the REST API. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to cause a permanent DoS condition that is due to high CPU utilization. Manual intervention may be required to recover the Cisco IND.
Weakness: CWE-20
Which versions are affected by CVE-2020-3567?
It affects 2 products.
Products include Cisco Industrial Network Director, Cisco Network Level Service.
How do I fix CVE-2020-3567?
No fix has been published for CVE-2020-3567 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-3567 being exploited?
There is no known exploitation of CVE-2020-3567 in the wild and no public exploit code.
Other vulnerabilities in Cisco Industrial Network Director
- CVE-2023-20036 Cisco Industrial Network Director Command Injection Vulnerability
- CVE-2023-20038 Hardcoded credentials in Cisco Industrial Network Director
- CVE-2019-1976 Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability
- CVE-2019-1861 Cisco Industrial Network Director Remote Code Execution Vulnerability
- CVE-2019-15973 Cisco Industrial Network Director Reflected Cross-Site Scripting Vulnerability
Sources
Also known as GHSA-5vp7-f4x6-7r58.