CVE-2020-3407CWE-476

Cisco IOS XE Software RESTCONF and NETCONF-YANG Access Control List Denial of Service Vulnerability

High · published September 24, 2020

CVSS v3.0
8.6
EPSS
2%
Percentile
74.2
In the wild
Unconfirmed
What it is

A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG feature. An attacker could exploit this vulnerability by accessing the device using RESTCONF or NETCONF-YANG. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

The record
Technical detail
CVSS v3.0
8.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01511 · 74.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2020-09-24T18:02Z
EPSS history
Timeline
  • 24 SEP 18:02Z
    Cisco IOS XE Software RESTCONF and NETCONF-YANG Access Control List Denial of Service Vulnerability
    cvelistv5