CVE-2020-3526

High

Description

A vulnerability in the Common Open Policy Service (COPS) engine of Cisco IOS XE Software on Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to crash a device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a malformed COPS message to the device. A successful exploit could allow the attacker to crash the device.

SeverityHigh

CVSS8.6

Exploit probability—

Product

Cisco Ios Xe

PublishedSep 24, 2020

First seenSep 24, 2020

Weakness typeCWE-20Improper input validation

How to fix

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-COPS-VLD-MpbTvGEW

Affected products

Product	Affected versions	Fixed in
cisco ios_xe	17.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.