Cisco Video Surveillance 8000 Series IP Camera prior 1.0.9-4 Cisco Discovery Protocol input validation

Summaryinfo

A vulnerability identified as critical has been detected in Cisco Video Surveillance 8000 Series IP Camera. Impacted is an unknown function of the component Cisco Discovery Protocol Handler. This manipulation causes input validation. The identification of this vulnerability is CVE-2020-3507. The attack needs to be done within the local network. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Video Surveillance 8000 Series IP Camera (Video Surveillance Software). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component Cisco Discovery Protocol Handler. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP camera. These vulnerabilities are due to missing checks when the IP cameras process a Cisco Discovery Protocol packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to the targeted IP camera. A successful exploit could allow the attacker to execute code on the affected IP camera or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

The weakness was shared 08/19/2020 as cisco-sa-ipcameras-rce-dos-uPy / CSCvu82728 / CSCvu82729 as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2020-3507. The attack can only be initiated within the local network. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.0.9-4 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entry VDB-160098 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Video Surveillance Software

Vendor

• Cisco

Name

• Video Surveillance 8000 Series IP Camera

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion