Skip to content
Fencer Intel
high 8.8

CVE-2020-3118 kev in the critical feed json

Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability

published 6y ago modified 4mo ago also EUVD-2020-24389

cvss
8.8
version 3.0, CNA
cisa kev
Exploited
added 2021-11-03
epss
11.7%
EPSS 11.7% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

Patch / fix

cisa required action Apply updates per vendor instructions.

  • Cisco Cisco IOS XR Software 6.6.3

Is CVE-2020-3118 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
5y ago
Patch by
2022-05-03 (4y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Cisco, IOS XR
CISA name
Cisco IOS XR Software Discovery Protocol Format String Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

11.69% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Cisco Cisco IOS XR Software

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String
  • CWE-787 Out-of-bounds Write
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.