Security readout for executives and security teams
Plain-English summary
CVE-2020-3422 can let an unauthenticated remote attacker disrupt services on affected Cisco IOS XE devices by abusing the IP SLA responder feature. The issue can cause another configured feature’s port to be consumed by IP SLA responder, leading to denial of service. The bundle does not provide exact affected versions.
Executive priority
Treat this as a high-priority network availability risk, especially for critical routing and infrastructure devices. There is no bundle evidence of active exploitation, but the remote unauthenticated nature and high availability impact justify prompt inventory and vendor-guided remediation.
Technical view
Cisco describes a flaw in IOS XE IP SLA responder port handling. Crafted IP SLA control traffic can make the responder reuse or consume a port needed by another configured feature, affecting availability. CVSS is 8.6 with network attack vector, low complexity, no privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely on Cisco IOS XE devices where IP SLA responder is enabled and reachable by untrusted network traffic. Exact vulnerable versions and configuration details are not included in the source bundle.
Exploitation context
The CVE is not listed as CISA KEV in the bundle, and no cited source states active exploitation. The described attack is remote and unauthenticated, but depends on IP SLA responder reachability and interaction with another configured feature’s port.
Researcher notes
The public bundle supports availability-only impact and Cisco IOS XE as the affected product. It does not include affected release ranges, fixed releases, or confirmed exploitation. Avoid assuming broader Cisco product exposure without the vendor advisory details.
Mitigation direction
- Review Cisco’s advisory for affected releases, fixed software, and configuration guidance.
- Inventory Cisco IOS XE devices running or exposing IP SLA responder.
- Prioritize remediation for internet-facing or broadly reachable network infrastructure.
- Restrict responder reachability where vendor guidance and operations permit.
- Track vendor updates because the bundle does not name a specific fix.
Validation and detection
- Confirm whether Cisco IOS XE is present in managed network device inventory.
- Check whether IP SLA responder is enabled on candidate devices.
- Determine whether untrusted networks can reach IP SLA responder traffic paths.
- Map dependent features using service ports on affected devices.
- Compare software releases against Cisco’s advisory and change records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-371: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-3422 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H3.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.6HighVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- 20200924 Cisco IOS XE Software IP Service Level Agreements Denial of Service VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.