Vulnerability · Published Sep 24, 2020 · Assigned by cisco

CVE-2020-3418Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family Improper Access Control Vulnerability

Medium 4.7

In plain English

A medium-severity improper access control in Cisco IOS XE Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.0)4.7Medium

Exploit odds (30 days)0.4%top 64.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9800 Series Routers could allow an unauthenticated, adjacent attacker to send ICMPv6 traffic prior to the client being placed into RUN state. The vulnerability is due to an incomplete access control list (ACL) being applied prior to RUN state. An attacker could exploit this vulnerability by connecting to the associated service set identifier (SSID) and sending ICMPv6 traffic. A successful exploit could allow the attacker to send ICMPv6 traffic prior to RUN state.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco IOS XE Software	n/a

Weakness: CWE-284 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References

20200924 Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family Improper Access Control Vulnerability vendor-advisory, x_refsource_CISCO