CDPwn: five Cisco CDP flaws, one exploited
One crafted packet from the next port. In February 2020, Armis disclosed CDPwn: five flaws in the way Cisco devices read Cisco Discovery Protocol messages, four of them leading to code execution.
The attacker needs no account, only a place in the same broadcast domain as the device. In October 2020, Cisco received reports of attempted exploitation of one of them in the wild.
The official record
Cisco published five advisories on 5 February 2020, crediting Armis. CVE-2020-3118 on IOS XR and CVE-2020-3119 on NX-OS: a stack overflow, then code with administrative privileges. CVE-2020-3111 on Cisco IP phones: code as root. CVE-2020-3110 on Video Surveillance 8000 Series IP cameras: code execution. NVD scores all four 8.8.
The fifth, CVE-2020-3120, exhausts memory and reloads devices running FXOS, IOS XR or NX-OS; NVD scores it 6.5. Cisco states that the flaws on IOS XR and NX-OS do not affect Cisco IOS or IOS XE.
How easy is it?
CDP is a layer 2 protocol: Cisco notes that the attacker must be in the same broadcast domain as the device. No account is needed.
Defaults decide the exposure. On NX-OS, CDP is on by default, globally and on every interface. On IOS XR it is off by default. On most Cisco IP phone models it is on.
Cisco updated the IOS XR advisory on 20 October 2020 after reports of attempted exploitation of CVE-2020-3118, and CISA added it to its catalog of known exploited vulnerabilities on 3 November 2021. The other four are not in that catalog.
How it works, in principle
A device processes the CDP messages that arrive on its ports, and sending one takes no credentials. In the vulnerable releases, the parser did not properly validate certain fields of the message.
On IOS XR, string input from those fields was mishandled; on NX-OS, a field overflowed the stack. Either way, a crafted message could run code on the device, or make it reload.
The impact
Code with administrative privileges on an IOS XR router or a Nexus switch, code as root on a desk phone, code execution on a camera, or a reload that takes the device off the network.
And a switch or a router is what the other segments rely on: code running there sits inside every VLAN the device carries.
How to close it
Upgrade: Cisco lists no workaround. Among the fixed releases are IOS XR 6.6.3 and 7.0.2, NX-OS 7.0(3)I7(8) and 9.3(2) on Nexus 3000 and 9000, firmware 12.7(1) on the 7800 and 8800 phones, and 1.0.7 on the cameras.
Where CDP is not used, Cisco notes that turning it off globally fully closes the attack vector, and turning it off per interface reduces the attack surface: no cdp on IOS XR, no cdp enable on NX-OS. Phones rely on CDP for their voice VLAN, so there, the answer is the firmware.
What NacTrack shows
NacTrack collects CDP and LLDP from every device over SSH, so it shows where CDP runs and what each port faces. It reads versions and configurations off your devices, and checks them against published advisories.
Sources
Sources: Cisco advisories of 5 February 2020 (cisco-sa-20200205-iosxr-cdp-rce, nxos-cdp-rce, voip-phones-rce-dos, ipcameras-rce-dos, fxnxos-iosxr-cdp-dos), Armis, NVD, CISA KEV.
Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.
Know where your network is exposed
NacTrack reads versions and configurations off your devices, and checks them against published advisories.