7.4

CVE-2020-3409

A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Ios Version15.2(7)e
   Cisco ≫ Ie-4000-16gt4g-e Version-
   Cisco ≫ Ie-4000-16t4g-e Version-
   Cisco ≫ Ie-4000-4gc4gp4g-e Version-
   Cisco ≫ Ie-4000-4gs8gp4g-e Version-
   Cisco ≫ Ie-4000-4s8p4g-e Version-
   Cisco ≫ Ie-4000-4t4p4g-e Version-
   Cisco ≫ Ie-4000-4tc4g-e Version-
   Cisco ≫ Ie-4000-8gs4g-e Version-
   Cisco ≫ Ie-4000-8gt4g-e Version-
   Cisco ≫ Ie-4000-8gt8gp4g-e Version-
   Cisco ≫ Ie-4000-8s4g-e Version-
   Cisco ≫ Ie-4000-8t4g-e Version-
Cisco ≫ Ios Xe Version15.2(7)e
   Cisco ≫ Ie-4000-16gt4g-e Version-
   Cisco ≫ Ie-4000-16t4g-e Version-
   Cisco ≫ Ie-4000-4gc4gp4g-e Version-
   Cisco ≫ Ie-4000-4gs8gp4g-e Version-
   Cisco ≫ Ie-4000-4s8p4g-e Version-
   Cisco ≫ Ie-4000-4t4p4g-e Version-
   Cisco ≫ Ie-4000-4tc4g-e Version-
   Cisco ≫ Ie-4000-8gs4g-e Version-
   Cisco ≫ Ie-4000-8gt4g-e Version-
   Cisco ≫ Ie-4000-8gt8gp4g-e Version-
   Cisco ≫ Ie-4000-8s4g-e Version-
   Cisco ≫ Ie-4000-8t4g-e Version-
Cisco ≫ Ios Xe Version16.11.1a
   Cisco ≫ Ie-3200-8p2s-e Version-
   Cisco ≫ Ie-3200-8t2s-e Version-
   Cisco ≫ Ie-3300-8p2s-a Version-
   Cisco ≫ Ie-3300-8p2s-e Version-
   Cisco ≫ Ie-3300-8t2s-a Version-
   Cisco ≫ Ie-3300-8t2s-e Version-
   Cisco ≫ Ie-3300-8t2x-a Version-
   Cisco ≫ Ie-3300-8t2x-e Version-
   Cisco ≫ Ie-3400-8p2s-a Version-
   Cisco ≫ Ie-3400-8p2s-e Version-
   Cisco ≫ Ie-3400-8t2s-e Version-
   Cisco ≫ Iem-3300-14t2s Version-
   Cisco ≫ Iem-3300-16p Version-
   Cisco ≫ Iem-3300-16t Version-
   Cisco ≫ Iem-3300-6t2s Version-
   Cisco ≫ Iem-3300-8p Version-
   Cisco ≫ Iem-3300-8s Version-
   Cisco ≫ Iem-3300-8t Version-
   Cisco ≫ Iem-3400-8p Version-
   Cisco ≫ Iem-3400-8s Version-
   Cisco ≫ Iem-3400-8t Version-
Cisco ≫ Ios Version16.11.1a
   Cisco ≫ Ie-3200-8p2s-e Version-
   Cisco ≫ Ie-3200-8t2s-e Version-
   Cisco ≫ Ie-3300-8p2s-a Version-
   Cisco ≫ Ie-3300-8p2s-e Version-
   Cisco ≫ Ie-3300-8t2s-a Version-
   Cisco ≫ Ie-3300-8t2s-e Version-
   Cisco ≫ Ie-3300-8t2x-a Version-
   Cisco ≫ Ie-3300-8t2x-e Version-
   Cisco ≫ Ie-3400-8p2s-a Version-
   Cisco ≫ Ie-3400-8p2s-e Version-
   Cisco ≫ Ie-3400-8t2s-e Version-
   Cisco ≫ Iem-3300-14t2s Version-
   Cisco ≫ Iem-3300-16p Version-
   Cisco ≫ Iem-3300-16t Version-
   Cisco ≫ Iem-3300-6t2s Version-
   Cisco ≫ Iem-3300-8p Version-
   Cisco ≫ Iem-3300-8s Version-
   Cisco ≫ Iem-3300-8t Version-
   Cisco ≫ Iem-3400-8p Version-
   Cisco ≫ Iem-3400-8s Version-
   Cisco ≫ Iem-3400-8t Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.08% 0.234
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.4 2.8 4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvd@nist.gov 6.1 6.5 6.9
AV:A/AC:L/Au:N/C:N/I:N/A:C
psirt@cisco.com 7.4 2.8 4
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.