{"containers": {"cna": {"affected": [{"product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2020-11-10T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource allocation when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this vulnerability by sending specific streams of Layer 2 or Layer 3 protocol data units (PDUs) to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could make the device unable to process or forward traffic, resulting in a DoS condition. The device would need to be restarted to regain functionality."}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-404", "description": "CWE-404", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-12T02:05:13", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20201110 Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY"}], "source": {"advisory": "cisco-sa-xr-cp-dos-ej8VB9QY", "defect": [["CSCvv09115"]], "discovery": "INTERNAL"}, "title": "Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2020-11-10T16:00:00", "ID": "CVE-2020-26070", "STATE": "PUBLIC", "TITLE": "Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco IOS XR Software", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "Cisco"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource allocation when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this vulnerability by sending specific streams of Layer 2 or Layer 3 protocol data units (PDUs) to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could make the device unable to process or forward traffic, resulting in a DoS condition. The device would need to be restarted to regain functionality."}]}, "exploit": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "impact": {"cvss": {"baseScore": "8.6", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-404"}]}]}, "references": {"reference_data": [{"name": "20201110 Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability", "refsource": "CISCO", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY"}]}, "source": {"advisory": "cisco-sa-xr-cp-dos-ej8VB9QY", "defect": [["CSCvv09115"]], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:49:06.682Z"}, "title": "CVE Program Container", "references": [{"name": "20201110 Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2020-26070", "datePublished": "2020-11-12T02:05:13.841123Z", "dateReserved": "2020-09-24T00:00:00", "dateUpdated": "2024-09-16T16:43:14.734Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "matchCriteriaId": "413EC528-53D8-4E5C-9137-84D9F337B420", "versionEndExcluding": "6.7.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF281839-E74A-4BCB-ADFA-44D7C47D3B1A", "versionEndExcluding": "7.1.2", "versionStartIncluding": "7.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:asr_9000v:v2:*:*:*:*:*:*:*", "matchCriteriaId": "C6B6AF64-42FF-4411-85EA-9AE537383CD6", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*", "matchCriteriaId": "324C97E6-1810-404F-9F45-6240F99FF039", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*", "matchCriteriaId": "57EB55BB-41B7-40A1-B6F5-142FE8AB4C16", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*", "matchCriteriaId": "433F4A82-04A4-4EAA-8C19-F7581DCD8D29", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*", "matchCriteriaId": "2D5E60AB-94FF-448A-89D8-5D2197E21C74", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*", "matchCriteriaId": "FA241214-2F05-4360-9B50-385355E29CF4", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*", "matchCriteriaId": "A93212A4-50AB-42E7-89A4-5FBBAEA050C3", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*", "matchCriteriaId": "EDA53A61-98B3-458C-8893-61CD7D6B1E48", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*", "matchCriteriaId": "F396564E-B477-4A27-A189-CEB737552E25", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*", "matchCriteriaId": "5445CC54-ACFB-4070-AF26-F91FEAA85181", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7AA58E5-D7E1-48CF-93FF-C60EB85B2BC7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource allocation when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this vulnerability by sending specific streams of Layer 2 or Layer 3 protocol data units (PDUs) to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could make the device unable to process or forward traffic, resulting in a DoS condition. The device would need to be restarted to regain functionality."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n de procesamiento de paquetes de entrada de Cisco IOS XR Software para Cisco ASR 9000 Series Aggregation Services Routers, podr\u00eda permitir a un atacante remoto no autenticado causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. La vulnerabilidad es debido a una asignaci\u00f3n inapropiada de recursos cuando un dispositivo afectado procesa el tr\u00e1fico de red en modo de switching de software (punteado). Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de secuencias espec\u00edficas de unidades de datos de protocolo (PDU) de capa 2 o capa 3 hacia un dispositivo afectado. Un explotaci\u00f3n con \u00e9xito podr\u00eda causar a un dispositivo afectado quedarse sin recursos de b\u00fafer, que podr\u00eda hacer que el dispositivo se inhabilite para procesar o reenviar el tr\u00e1fico, resultando en una condici\u00f3n DoS. El dispositivo deber\u00e1 ser reiniciado para recuperar la funcionalidad"}], "id": "CVE-2020-26070", "lastModified": "2023-11-07T03:20:29.040", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2020-11-12T02:15:11.057", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-404"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}