CVE-2020-3110

A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to the targeted IP Camera. A successful exploit could allow the attacker to expose the affected IP Camera for remote code execution or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). This vulnerability is fixed in Video Surveillance 8000 Series IP Camera Firmware Release 1.0.7 and later.

• CVE ID
• CVE-2020-3110

• Assigner
• ykramarz@cisco.com

• Vulnerability Status
• Analyzed

• Published Version
• 2020-02-05T18:15:10

• Last Modified Date
• 2020-02-07T18:52:40

• Version
• 2.0

• Vector String
• AV:A/AC:L/Au:N/C:C/I:C/A:C

• Access Vector
• ADJACENT_NETWORK

• Access Compatibility
• LOW

• Authentication
• NONE

• Confidentiality Impact
• COMPLETE

• Integrity Impact
• COMPLETE

• Availability Impact
• COMPLETE

• Base Score
• 8.3

• Severity
• HIGH

• Exploitability Score
• 6.5

• Impact Score
• 10

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector
• ADJACENT_NETWORK

• Attack Compatibility
• LOW

• Privileges Required
• NONE

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• HIGH

• Base Score
• 8.8

• Base Severity
• HIGH

• Exploitability Score
• 2.8

• Impact Score
• 5.9