LiveActive security incident?Get immediate response
CVE Record

CVE-2020-3567: Cisco Industrial Network Director Denial of Service Vulnerability

A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remote attacker to cause the CPU utilization to increase to 100 percent, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of requests sent to the REST API. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to cause a permanent DoS condition that is due to high CPU utilization. Manual intervention may be required to recover the Cisco IND.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Cisco Industrial Network Director has a management API flaw that can let an authenticated remote attacker exhaust CPU resources. The result can be a lasting outage of the IND management system, with manual recovery possibly required.

Executive priority

Treat as a moderate OT management availability risk. Prioritize remediation where Cisco IND supports operational visibility or incident response, especially if many users can reach the management API.

Technical view

The issue is insufficient request validation in the Cisco IND management REST API, classified as CWE-20. CVSS 3.1 is 6.5: network reachable, low complexity, low privileges required, no user interaction, and high availability impact.

Likely exposure

Exposure is most likely where Cisco Industrial Network Director is deployed and its management REST API is reachable by authenticated users. Risk increases if administrative networks are broadly accessible or accounts are weakly controlled.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires authenticated access and a crafted REST API request; the documented impact is denial of service, not data theft or code execution.

Researcher notes

The source bundle identifies only Cisco Industrial Network Director and does not include version ranges, patch names, or workaround details. Avoid expanding affected scope beyond Cisco’s advisory without additional evidence.

Mitigation direction

  • Review Cisco advisory for affected releases, fixed software, and supported workarounds.
  • Restrict Cisco IND management REST API access to trusted administration networks.
  • Enforce least privilege for IND users and remove stale accounts.
  • Monitor IND CPU saturation and management availability until remediation is complete.
  • Prepare manual recovery procedures for an IND denial-of-service event.

Validation and detection

  • Inventory Cisco IND deployments and record reachable management interfaces.
  • Confirm whether installed IND versions match Cisco advisory exposure details.
  • Review access controls for the management REST API.
  • Check monitoring history for unexplained sustained 100 percent CPU events.
  • Verify remediation against Cisco guidance after changes are applied.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-3567 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2020-3567Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco Industrial Network Directorn/aListed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.