Cisco Video Surveillance 8000 Series IP Camera prior 1.0.9-4 Cisco Discovery Protocol input validation

Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco Video Surveillance 8000 Series IP Camera. This issue affects some unknown processing of the component Cisco Discovery Protocol Handler. The manipulation results in input validation. This vulnerability was named CVE-2020-3506. The attack needs to be approached within the local network. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Video Surveillance 8000 Series IP Camera (Video Surveillance Software). It has been classified as critical. Affected is an unknown functionality of the component Cisco Discovery Protocol Handler. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP camera. These vulnerabilities are due to missing checks when the IP cameras process a Cisco Discovery Protocol packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to the targeted IP camera. A successful exploit could allow the attacker to execute code on the affected IP camera or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

The weakness was presented 08/19/2020 as cisco-sa-ipcameras-rce-dos-uPy / CSCvu82728 / CSCvu82729 as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability is traded as CVE-2020-3506. The attack can only be done within the local network. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

Upgrading to version 1.0.9-4 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

See VDB-160099 for similar entry. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Video Surveillance Software

Vendor

• Cisco

Name

• Video Surveillance 8000 Series IP Camera

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion