Cisco IOS XE CAPWAP DoS Vulnerabilities Advisory (CVE-2020-3486/3487/3488)

Critical Vulnerability Information Title: Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service Vulnerabilities Risk Level: High Advisory ID: cisco-sa-capwap-dos-TPdNTdyq Initial Release Date: September 24, 2020, 16:00 GMT CVEs: CVE-2020-3486, CVE-2020-3487, CVE-2020-3488 CVSS Score: 7.4 base Cisco Bug IDs: CScv51353, CScv52613, CScv76792 CWE: CWE-20 --- Summary Multiple vulnerabilities exist in the CAPWAP protocol handling process for controlling and provisioning wireless access points in Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers. Unauthenticated remote attackers could exploit these vulnerabilities to launch denial-of-service (DoS) attacks against affected devices. --- Affected Products Catalyst 9800 Series Wireless Controllers Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches Embedded Wireless Controller on Catalyst 9100 Access Points --- No Workarounds Available --- Fixed Software Cisco has released free software updates to address the vulnerabilities described in this advisory. Customers are only entitled to support for software versions and feature sets for which they have purchased licenses. By installing, downloading, accessing, or otherwise using these software updates, customers agree to comply with Cisco's software license terms. --- Public Exploits and Announcements Cisco Product Security Incident Response Team (PSIRT) has not identified any public announcements or malicious exploitation related to the vulnerabilities described in this advisory. --- Source: These vulnerabilities were discovered during internal security testing.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IOS XE CAPWAP DoS Vulnerabilities Advisory (CVE-2020-3486/3487/3488)