CVE-2020-3118
Cisco IOS XR Software Discovery Protocol Format String Vulnerability
Description
CVE-2020-3118 is a HIGH severity remote code execution vulnerability in the Cisco Discovery Protocol (CDP) implementation for Cisco IOS XR Software, classified under CWE-134 (Use of Externally-Controlled Format String) and CWE-787 (Out-of-bounds Write). The vulnerability arises from improper validation of string input in certain fields of CDP messages, allowing an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a device reload. With a CVSS 3.1 score of 8.8 and an EPSS score of 0.00294 (52.42nd percentile), the vulnerability requires Layer 2 adjacency but carries severe consequences. CISA added it to the KEV catalog on November 3, 2021.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios xr | >= 6.6.0, < 6.6.12; >= 7.0.0, < 7.0.2; 6.5.3; 5.2.5; 6.4.2; 6.6.25; 7.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html(Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3118(US Government Resource)
Weakness Type
CWE-134: Use of Externally-Controlled Format String
Use of Externally-Controlled Format String occurs when software uses a function that accepts a format string as an argument, but the format string originates from an external source such as user input or network data. Format string functions like printf(), sprintf(), and syslog() interpret special format specifiers (e.g., %s, %x, %n) within the string. When an attacker can control the format string, they can read from or write to arbitrary memory locations, crash the application, or execute arbitrary code.
In the context of CVE-2020-3118, the Cisco Discovery Protocol implementation in IOS XR Software processes string fields from incoming CDP messages using format string functions without proper sanitization. CDP is a Layer 2 protocol used for network device discovery, and devices automatically process CDP messages received on all active interfaces. An attacker on the same broadcast domain can send a malicious CDP packet containing format string specifiers in fields that are subsequently passed to a format string function, causing a stack overflow that enables arbitrary code execution with administrative privileges or triggers a device reload.
Learn more: CWE-134 — Use of Externally-Controlled Format String
Impact Analysis
CVE-2020-3118 carries a CVSS 3.1 base score of 8.8 (HIGH) with adjacent-network attack characteristics.
Confidentiality (High): Successful exploitation grants administrative-level code execution on the affected IOS XR device. This provides complete access to the device configuration, routing tables, SNMP credentials, authentication secrets, and all traffic flowing through the router. An attacker with administrative access can capture and exfiltrate sensitive data traversing the device.
Integrity (High): Administrative code execution allows the attacker to modify any aspect of the device configuration, including routing protocols (BGP, OSPF, IS-IS), access control lists, MPLS label switching paths, and interface configurations. The attacker can redirect traffic, create unauthorized network tunnels, and install persistent backdoors that survive device reloads.
Availability (High): The vulnerability can directly cause a device reload, resulting in immediate loss of all network services provided by the affected router. In service provider environments running IOS XR, this can disrupt connectivity for large numbers of customers. Repeated exploitation can cause sustained outages that persist until the vulnerability is mitigated.
Scope (Unchanged): The scope is unchanged in the CVSS assessment, but compromising a core IOS XR router in a service provider or enterprise backbone can cascade into widespread connectivity disruptions. The adjacent-network requirement (Layer 2) limits remote exploitation but does not prevent attacks from compromised hosts on the same network segment.
Exploit Maturity
Active Exploitation: CVE-2020-3118 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on November 3, 2021, with a remediation deadline of May 3, 2022 for federal agencies.
Public Exploit Information: Details about the vulnerability were published by Armis Research as part of the CDPwn research, which identified multiple critical vulnerabilities in the Cisco Discovery Protocol across various Cisco product lines. A public disclosure is available on Packet Storm Security describing the CDP remote device takeover technique.
Attack Vector Constraints: While the adjacent-network requirement limits the attack surface compared to remotely exploitable vulnerabilities, CDP is enabled by default on all Cisco interfaces. Any compromised device on the same Layer 2 segment can be used as a pivot point to exploit this vulnerability.
EPSS Context: The EPSS score of 0.00294 (52.42nd percentile) is moderate, reflecting the Layer 2 adjacency requirement that limits opportunistic exploitation. However, the KEV listing confirms real-world exploitation in targeted attacks.
Affected Versions: Multiple IOS XR versions are affected, including 5.2.5, 6.4.2, 6.5.3, 6.6.2 through 6.6.25, and 7.0.x through 7.0.2.
Remediation
-
Apply Cisco IOS XR software updates immediately. Install the patched versions as described in Cisco Security Advisory cisco-sa-20200205-iosxr-cdp-rce. Prioritize routers in environments where Layer 2 access cannot be strictly controlled.
-
Disable CDP on interfaces where it is not required. Use the command
no cdp enableon individual interfaces orno cdp runglobally to disable CDP entirely. This eliminates the attack surface for this vulnerability. -
Implement Layer 2 security controls. Deploy 802.1X port-based authentication to restrict which devices can connect to network segments containing IOS XR routers. Use private VLANs and port security features to limit the broadcast domain.
-
Consider migrating to LLDP. Where a discovery protocol is needed, consider using Link Layer Discovery Protocol (LLDP) instead of CDP, as it is an industry standard and not affected by this specific vulnerability.
-
Monitor for suspicious CDP activity. Implement network monitoring to detect anomalous CDP packets, particularly those with unusual field lengths or unexpected format string characters in device identification fields.
-
Segment management and data planes. Ensure that management interfaces on IOS XR routers are on dedicated management networks, reducing the likelihood that an attacker on a data plane segment can reach management interfaces running CDP.
Technical Details
CVE-2020-3118 is a format string vulnerability in the Cisco Discovery Protocol implementation of Cisco IOS XR Software. CDP is a Layer 2 protocol that enables Cisco devices to discover and share information with directly connected Cisco equipment. The protocol operates at the data link layer and processes messages from any device on the same broadcast domain.
The vulnerability exists because the IOS XR CDP implementation passes certain string fields from incoming CDP messages directly to format string functions without sanitization. When a CDP packet contains format string specifiers such as %s, %x, or %n in fields like the Device ID or Platform field, the format string function interprets these specifiers and performs corresponding memory operations. The %n specifier is particularly dangerous as it writes to memory, enabling arbitrary code execution.
The exploitation chain involves an attacker crafting a CDP packet with format string specifiers embedded in one of the string fields. When the target IOS XR device receives and processes this CDP packet, the format string function dereferences stack values as pointers, leading to a stack overflow condition. By carefully crafting the format string payload, the attacker can overwrite return addresses on the stack and redirect execution to attacker-controlled shellcode.
The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires adjacent network access (Layer 2) but has low complexity and needs no authentication or user interaction. The adjacency requirement means the attacker must be in the same broadcast domain as the target, but CDP is typically enabled on all interfaces by default, including those facing access networks.
Frequently Asked Questions
Is CVE-2020-3118 being actively exploited?
Yes, CVE-2020-3118 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. The vulnerability was part of the CDPwn research by Armis that revealed critical flaws in the Cisco Discovery Protocol. While the Layer 2 adjacency requirement limits opportunistic attacks, targeted exploitation has been confirmed.
What products are affected by CVE-2020-3118?
CVE-2020-3118 affects Cisco devices running IOS XR Software with Cisco Discovery Protocol enabled. Affected versions include IOS XR 5.2.5, 6.4.2, 6.5.3, 6.6.x through 6.6.25, and 7.0.x through 7.0.2. IOS XR is primarily used on Cisco's service provider and large enterprise routers such as the ASR 9000, NCS 5500, and CRS series.
How do I fix CVE-2020-3118?
Apply the software update from Cisco as described in the security advisory. As an immediate mitigation, disable CDP on interfaces where it is not needed using no cdp enable. Consider disabling CDP globally with no cdp run if the discovery protocol is not required. Implement Layer 2 security controls such as 802.1X to limit which devices can send CDP packets.
How severe is CVE-2020-3118?
CVE-2020-3118 is rated HIGH with a CVSS score of 8.8. While it requires Layer 2 adjacency, successful exploitation grants administrative code execution on IOS XR routers, which are typically deployed in critical backbone and service provider networks. A compromised core router can disrupt connectivity for thousands of users and expose all transit traffic to interception.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.