Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce) - Nessus
High Plugin ID: 133603This page contains detailed information about the Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.
Plugin Overview
ID: 133603
Name: Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce)
Filename: cisco-sa-20200205-iosxr-cdp-rce.nasl
Vulnerability Published: 2020-02-05
This Plugin Published: 2020-02-10
Last Modification Time: 2022-01-24
Plugin Version: 1.9
Plugin Type: combined
Plugin Family: CISCO
Dependencies:
cisco_ios_xr_version.nasl
Required KB Items [?]: Host/Cisco/IOS-XR/Version
Vulnerability Information
Severity: High
Vulnerability Published: 2020-02-05
Patch Published: 2020-02-05
CVE [?]: CVE-2020-3118
CPE [?]: cpe:/o:cisco:ios_xr
Synopsis
The remote device is missing a vendor-supplied security patch
Description
According to its self-reported version, the Cisco IOS XR Software is affected by a remote code execution vulnerability within the Cisco Discovery Protocol due to improper validation of string input. An unauthenticated, adjacent attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges.
Please see the included Cisco BIDs and Cisco Security Advisory for more information
Solution
Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvr09190.
Public Exploits
Target Network Port(s): N/A
Target Asset(s): N/A
Exploit Available: True (GitHub)
Exploit Ease: Exploits are available
Here's the list of publicly known exploits and PoCs for verifying the Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce) vulnerability:
- GitHub: https://github.com/epi052/CiscoNotes
[CVE-2020-3118]
Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.
WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.
Risk Information
CVSS Score Source [?]: CVE-2020-3118
CVSS V2 Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C
CVSS Base Score: | 8.3 (High) |
Impact Subscore: | 10.0 |
Exploitability Subscore: | 6.5 |
CVSS Temporal Score: | 7.2 (High) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 7.2 (High) |
CVSS Base Score: | 8.8 (High) |
Impact Subscore: | 5.9 |
Exploitability Subscore: | 2.8 |
CVSS Temporal Score: | 8.4 (High) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 8.4 (High) |
STIG Risk Rating: High
Go back to menu.
Plugin Source
This is the cisco-sa-20200205-iosxr-cdp-rce.nasl nessus plugin source code. This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(133603);
script_version("1.9");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/01/24");
script_cve_id("CVE-2020-3118");
script_xref(name:"CISCO-BUG-ID", value:"CSCvr09190");
script_xref(name:"CISCO-SA", value:"cisco-sa-20200205-iosxr-cdp-rce");
script_xref(name:"IAVA", value:"2020-A-0041-S");
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");
script_name(english:"Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Cisco IOS XR Software is affected by a remote code execution vulnerability
within the Cisco Discovery Protocol due to improper validation of string input. An unauthenticated, adjacent
attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges.
Please see the included Cisco BIDs and Cisco Security Advisory for more information");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b9623904");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr09190");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvr09190.");
script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3118");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/05");
script_set_attribute(attribute:"patch_publication_date", value:"2020/02/05");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/10");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_ios_xr_version.nasl");
script_require_keys("Host/Cisco/IOS-XR/Version");
exit(0);
}
include('audit.inc');
include('cisco_workarounds.inc');
include('ccf.inc');
product_info = cisco::get_product_info(name:'Cisco IOS XR');
model = get_kb_item('CISCO/model');
if (empty_or_null(model))
model = product_info['model'];
model = toupper(model);
if ('ASR9' >< model && 'X64' >!< model)
{
pies = make_array(
'6.4.2', 'asr9k-px-6.4.2.CSCvr78185',
'6.5.3', 'asr9k-px-6.5.3.CSCvr78185'
);
}
else if ('ASR9' >< model)
{
pies = make_array(
'6.5.3', 'asr9k-x64-6.5.3.CSCvr78185'
);
}
else if ('NCS5500' >< model)
{
pies = make_array(
'6.5.3', 'ncs5500-6.5.3.CSCvr78185'
);
}
else if ('NCS540' >< model && 'L' >!< model)
{
pies = make_array(
'6.5.3', 'ncs540-6.5.3.CSCvr78185'
);
}
else if ('NCS6' >< model)
{
pies = make_array(
'5.2.5', ' ncs6k-5.2.5.CSCvr78185'
);
}
else if ('XRV9' >< model || 'XRV 9' >< model)
{
pies = make_array(
'6.6.2', 'xrv9k-6.5.3.CSCvr78185'
);
}
else if ('NCS560' >< model)
{
pies = make_array(
'6.6.25', 'ncs560-6.6.25.CSCvr78185'
);
}
else if ('CRS-PX' >< model)
{
pies = make_array(
'6.4.2', 'hfr-px-6.4.2.CSCvr78185'
);
}
else if ('NCS5k' >< model)
{
pies = make_array(
'6.5.3', 'ncs5k-6.5.3.CSCvr78185'
);
}
else if ('White box' >< model)
{
pies = make_array(
'6.6.12', 'iosxrwbd-6.6.12.CSCvr78185'
);
}
else if ('NCS540L' >< model)
{
pies = make_array(
'7.0.1', 'ncs540l-7.0.1.CSCvr78185'
);
}
# Check for patches
version = product_info['version'];
if (!empty_or_null(pies) && !empty_or_null(pies[version]))
{
fixed_ver = product_info['version'] + ' with patch ' + pies[version];
if (get_kb_item('Host/local_checks_enabled'))
{
buf = cisco_command_kb_item('Host/Cisco/Config/show_install_package_all', 'show install package all');
if (check_cisco_result(buf))
{
if (pies[version] >< buf)
audit(AUDIT_HOST_NOT, 'affected since patch '+pies[version]+' is installed');
}
}
}
vuln_ranges = [
{'min_ver' : '6.6.1', 'fix_ver' : '6.6.3'},
{'min_ver' : '6.6.25', 'fix_ver' : '7.0.2'}
];
workarounds = make_list(CISCO_WORKAROUNDS['cdp']);
workaround_params = make_list();
if (!empty_or_null(fixed_ver))
fixed_ver = fixed_ver + ' or upgrade to 6.6.3 / 7.0.2';
else
fixed_ver = 'Upgrade to 6.6.3 / 7.0.2';
reporting = make_array(
'port' , product_info['port'],
'severity' , SECURITY_HOLE,
'version' , product_info['version'],
'bug_id' , 'CSCvr09190',
'fix' , fixed_ver
);
cisco::check_and_report(
product_info:product_info,
workarounds:workarounds,
workaround_params:workaround_params,
reporting:reporting,
vuln_ranges:vuln_ranges,
router_only:TRUE
);
The latest version of this script can be found in these locations depending on your platform:
- Linux / Unix:
/opt/nessus/lib/nessus/plugins/cisco-sa-20200205-iosxr-cdp-rce.nasl
- Windows:
C:\ProgramData\Tenable\Nessus\nessus\plugins\cisco-sa-20200205-iosxr-cdp-rce.nasl
- Mac OS X:
/Library/Nessus/run/lib/nessus/plugins/cisco-sa-20200205-iosxr-cdp-rce.nasl
Go back to menu.
How to Run
Here is how to run the Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):
- Click to start a New Scan.
- Select Advanced Scan.
- Navigate to the Plugins tab.
- On the top right corner click to Disable All plugins.
- On the left side table select CISCO plugin family.
- On the right side table select Cisco IOS XR Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-iosxr-cdp-rce) plugin ID 133603.
- Specify the target on the Settings tab and click to Save the scan.
- Run the scan.
Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.
Basic usage:
/opt/nessus/bin/nasl cisco-sa-20200205-iosxr-cdp-rce.nasl -t <IP/HOST>
Run the plugin with audit trail message on the console:
/opt/nessus/bin/nasl -a cisco-sa-20200205-iosxr-cdp-rce.nasl -t <IP/HOST>
Run the plugin with trace script execution written to the console (useful for debugging):
/opt/nessus/bin/nasl -T - cisco-sa-20200205-iosxr-cdp-rce.nasl -t <IP/HOST>
Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):
/opt/nessus/bin/nasl -K /tmp/state cisco-sa-20200205-iosxr-cdp-rce.nasl -t <IP/HOST>
Go back to menu.
References
IAVA | Information Assurance Vulnerability Alert:
- 2020-A-0041-S
- https://www.tenable.com/plugins/nessus/133603
- https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr09190
- http://www.nessus.org/u?b9623904
- https://vulners.com/nessus/CISCO-SA-20200205-IOSXR-CDP-RCE.NASL
- 107004 - Cisco ASA Remote Code Execution and Denial of Service Vulnerability (cisco-sa-20180129-asa1) (destructive check)
- 69953 - Management Center for Cisco Security Agents Remote Code Execution (cisco-sa-20110216-csa)
- 79271 - Cisco Email Security Appliance Telnet Remote Code Execution (cisco-sa-20120126-ironport)
- 79272 - Cisco Content Security Management Appliance Telnet Remote Code Execution (cisco-sa-20120126-ironport)
- 79273 - Cisco Web Security Appliance Telnet Remote Code Execution (cisco-sa-20120126-ironport)
- 106630 - Cisco Firepower Threat Defense (FTD) Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability (cisco-sa-20180129-asa1)
- 106484 - Cisco ASA Remote Code Execution and Denial of Service Vulnerability (cisco-sa-20180129-asa1)
- 108722 - Cisco IOS Software Smart Install Remote Code Execution Vulnerability
- 108723 - Cisco IOS XE Software Smart Install Remote Code Execution Vulnerability
- 126640 - Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
- 133604 - Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability (cisco-sa-20200205-nxos-cdp-rce)
- 160400 - Cisco Identity Services Log4j Engine Remote Code Execution (cisco-sa-apache-log4j-qRuKNEbd)
- 137901 - Cisco IOS Software One Platform Kit Remote Code Execution Vulnerability (cisco-sa-ios-nxos-onepk-rce-6Hhyt4dC)
- 137902 - IOS XE Software One Platform Kit Remote Code Execution Vulnerability (cisco-sa-ios-nxos-onepk-rce-6Hhyt4dC)
- 137903 - Cisco NX-OS Software One Platform Kit Remote Code Execution Vulnerability (cisco-sa-ios-nxos-onepk-rce-6Hhyt4dC)
- 79584 - Cisco TelePresence Conductor Bash Remote Code Execution (Shellshock)
- 78596 - Cisco TelePresence Video Communication Server Bash Remote Code Execution (Shellshock)
Version
This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file cisco-sa-20200205-iosxr-cdp-rce.nasl version 1.9. For more plugins, visit the Nessus Plugin Library.
Go back to menu.