CVE-2020-3172 is a critical vulnerability in the Cisco Discovery Protocol (CDP) feature of Cisco FXOS and NX-OS Software. It allows an unauthenticated, adjacent attacker to execute arbitrary code as root or cause a denial of service (DoS) by sending a crafted CDP packet. The vulnerability stems from insufficient validation of CDP packet headers, leading to a buffer overflow. With a CVSS score of 8.8 (High), this vulnerability has a low attack complexity and requires the attacker to be Layer 2 adjacent to the affected device. A successful exploit could result in complete compromise of the device (confidentiality, integrity, and availability). Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting limited public awareness or immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.6.1.187CPE matchmatch criteria | cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:* | ||
>= 2.7, < 2.7.1.106CPE matchmatch criteria | cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:* | ||
< 3.2\(3n\)CPE matchmatch criteria | cpe:2.3:a:cisco:ucs_manager:*:*:*:*:*:*:*:* | ||
>= 4.0, < 4.0\(4g\)CPE matchmatch criteria | cpe:2.3:a:cisco:ucs_manager:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:nx-os:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.