CVE-2020-3230

Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability

Published Jun 3, 2020 CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Description
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2 SA-Init packets. An attacker could exploit this vulnerability by sending crafted IKEv2 SA-Init packets to the affected device. An exploit could allow the attacker to cause the affected device to reach the maximum incoming negotiation limits and prevent further IKEv2 security associations from being formed.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2020-24501 A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2 SA-Init packets. An attacker could exploit this vulnerability by sending crafted IKEv2 SA-Init packets to the affected device. An exploit could allow the attacker to cause the affected device to reach the maximum incoming negotiation limits and prevent further IKEv2 security associations from being formed.
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Weaknesses
  • CWE-20

    Improper Input Validation

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Nov 15, 2024, 5:14 PM
Reserved
Dec 12, 2019, 12:00 AM
Status
Modified
Published
Jun 3, 2020, 6:15 PM
Modified
Jun 17, 2026, 3:17 AM