Cisco IOS XE WPA2/WPA3 Authentication Packet input validation

Summaryinfo

A vulnerability classified as problematic has been found in Cisco IOS XE. Impacted is an unknown function of the component WPA2/WPA3. This manipulation as part of Authentication Packet causes input validation. This vulnerability is handled as CVE-2020-3429. The attack can only be done within the local network. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (version now known). It has been declared as problematic. Affected by this vulnerability is some unknown processing of the component WPA2/WPA3. The manipulation as part of a Authentication Packet leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect packet processing during the WPA2 and WPA3 authentication handshake when configured for dot1x or pre-shared key (PSK) authentication key management (AKM) with 802.11r BSS Fast Transition (FT) enabled. An attacker could exploit this vulnerability by sending a crafted authentication packet to an affected device. A successful exploit could cause an affected device to reload, resulting in a DoS condition.

The weakness was released 09/24/2020 as cisco-sa-wpa-dos-cXshjerc as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2020-3429 since 12/12/2019. Access to the local network is required for this attack to succeed. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-161885, VDB-161884, VDB-161883 and VDB-161882. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion