5 High Impact Flaws Affect Cisco Routers, Switches, IP Phones and Cameras

Four of the five high-severity bugs are remote code execution
issues affecting Cisco routers, switches, and IP cameras, whereas
the fifth vulnerability is a denial-of-service issue affecting
Cisco IP phones.

Collectively dubbed ‘CDPwn,’ the reported vulnerabilities
reside in the various implementations of the Cisco Discovery
Protocol (CDP) that comes enabled by default on virtually all Cisco
devices and can not be turned OFF.

Cisco Discovery Protocol (CDP) is an administrative protocol
that works at Layer 2 of the Internet Protocol (IP) stack. The
protocol has been designed to let devices discover information
about other locally attached Cisco equipment in the same
network.

According to a report Armis research team shared^[1] with The Hacker News,
the underlying CDP implementations contain buffer overflow and
format string vulnerabilities that could let remote attackers on
the same network execute arbitrary code on the vulnerable devices
by sending malicious unauthenticated CDP packets.

The list of CDPwn Cisco vulnerabilities affecting tens of
millions of devices widely deployed in enterprise networks is as
follow:

• Cisco NX-OS Stack Overflow in the Power Request TLV (CVE-2020-3119^[2])
• Cisco IOS XR Format String vulnerability in multiple TLVs
  (CVE-2020-3118^[3])
• Cisco IP Phones Stack Overflow in PortID TLV (CVE-2020-3111^[4])
• Cisco IP Cameras Heap Overflow in DeviceID TLV (CVE-2020-3110^[5])
• Cisco FXOS, IOS XR, and NX-OS Resource Exhaustion in the
  Addresses TLV (CVE-2020-3120^[6])

To be noted, since CDP is a Data Link layer 2 protocol that can’t
cross the boundaries of a local area network, an attacker first
needs to be on the same network to leverage CDPwn
vulnerabilities.
However, after gaining an initial foothold in a targeted network
using separate vulnerabilities, attackers can exploit CDPwn against
network switches to break network segmentation and move laterally
across the corporate networks to other sensitive systems and data.

“Gaining control over the switch is useful in other ways. For
example, the switch is in a prime position to eavesdrop on network
traffic that traverses through the switch, and it can even be used
to launch man-in-the-middle attacks on the traffic of devices that
traverses through the switch,” the researchers said.

“An attacker can look to move laterally across segments and gain
access to valuable devices like IP phones or cameras. Unlike
switches, these devices hold sensitive data directly, and the
reason to take them over can be a goal of an attacker, and not
merely a way to break out of segmentation.”

Additionally, CDPwn flaws also allow attackers to:

• Eavesdrop on voice and video data/calls and video feed from IP
  phones and cameras, capture sensitive conversations or images.
• Exfiltrate sensitive corporate data flowing through the
  corporate network’s switches and routers.
• Compromise additional devices by leveraging man-in-the-middle
  attacks to intercept and alter traffic on the corporate
  switch.

Besides releasing a detailed technical
report^[7] on the issues, the Armis
research team has also shared videos of explanation and
demonstration of the flaws, as embedded above.

Though Cisco has also provided some mitigation information,
affected administrators are still highly recommended to install the
latest software updates to completely protect their valuable
networks against malware and emerging online threats.