CVE-2020-3516

MEDIUM

Cisco IOS XE - Authenticated Denial of Service via Web Server Authentication Input

Title source: llm
STIX 2.1

Description

A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticated, remote attacker to crash the web server on the device. The vulnerability is due to insufficient input validation during authentication. An attacker could exploit this vulnerability by entering unexpected characters during a valid authentication. A successful exploit could allow the attacker to crash the web server on the device, which must be manually recovered by disabling and re-enabling the web server.

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0063
EPSS Percentile 70.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (2)
cisco/ios_xe 17.2.1
cisco/ios_xe < 16.9.6
Published Sep 24, 2020
Tracked Since Feb 18, 2026