CVE-2020-3230CWE-20

Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability

High · published June 3, 2020

CVSS v3.0
7.5
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2 SA-Init packets. An attacker could exploit this vulnerability by sending crafted IKEv2 SA-Init packets to the affected device. An exploit could allow the attacker to cause the affected device to reach the maximum incoming negotiation limits and prevent further IKEv2 security associations from being formed.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01714 · 77.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-06-03T17:42Z
EPSS history
Timeline
  • 03 JUN 17:42Z
    Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability
    cvelistv5