CVE-2020-3552
Status: ModifiedHigh (7.4)—
A vulnerability in the Ethernet packet handling of Cisco Aironet Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting as a wired client to the Ethernet interface of an affected device and sending a series of specific packets within a short time frame. A successful exploit could allow the attacker to cause a NULL pointer access that results in a reload of the affected device.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Base score: 7.4
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.49%
- Percentile among all scored CVEs: 40
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (4)
CWEs
- CWE-476
- CWE-476
References
Raw JSON (NVD)
Show
{
"id": "CVE-2020-3552",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2020-3552",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-11-13T17:23:40.472481Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.1,
"accessVector": "ADJACENT_NETWORK",
"vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 6.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.5,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 7.4,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 2.8
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 7.4,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Aironet Access Point Software",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2020-09-24T18:15:21.900",
"references": [
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ethport-dos-xtjTt8pY",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ethport-dos-xtjTt8pY",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Ethernet packet handling of Cisco Aironet Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting as a wired client to the Ethernet interface of an affected device and sending a series of specific packets within a short time frame. A successful exploit could allow the attacker to cause a NULL pointer access that results in a reload of the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el manejo de paquetes Ethernet de Cisco Aironet Access Points (APs) Software, podría permitir a un atacante adyacente no autenticado causar una condición de denegación de servicio (DoS) en un dispositivo afectado. La vulnerabilidad es debido a una comprobación insuficiente de la entrada. Un atacante podría explotar esta vulnerabilidad mediante la conexión como un cliente cableado a la interfaz Ethernet de un dispositivo afectado y mediante el envío de una serie de paquetes específicos en un corto período de tiempo. Una explotación con éxito podría permitir al atacante causar un acceso al puntero NULL que resulte en una recarga del dispositivo afectado."
}
],
"lastModified": "2026-06-17T03:18:34.717",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:wireless_lan_controller:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8EFE8F9-5E37-42DF-8658-574A5D9ECC6D",
"versionEndExcluding": "8.10.105.0",
"versionStartIncluding": "8.6"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:aironet_1542d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C5DB7510-2741-464A-8FC9-8419985E330F"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1542i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3AE916B2-CAAD-4508-A47E-A7D4D88B077A"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1562d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1D717945-EE41-4D0F-86EF-90826EBE9C3E"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1562e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "99EAEA92-6589-4DFB-BC4B-8CBA425452D9"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1562i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D27AB201-342D-4517-9E05-6088598F4695"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "36F923CF-D4EB-48F8-821D-8BB3A69ABB62"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1815:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F8BF9DDB-884D-47B5-A295-8BFA5207C412"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1830e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4590D445-B4B6-48E6-BF55-BEA6BA763410"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1830i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "848CC5CD-1982-4F31-A626-BD567E1C19F0"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1840:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A69CA9D6-914D-436F-AA81-B218CC312D29"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1850e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "24E47788-9B54-42C5-AD83-428B22674575"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1850i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A333CD0B-4729-4E64-8B52-A3F5138F5B70"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_2800e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "098A82FF-95F7-416A-BADD-C57CE81ACD32"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_2800i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DD1D5813-9223-4B3F-9DE2-F3EF854FC927"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_3800e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "10D7583E-2B61-40F1-B9A6-701DA08F8CDF"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_3800i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "945DDBE7-6233-416B-9BEE-7029F047E298"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_3800p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0ED89428-750C-4C26-B2A1-E3D63F8B3F44"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_4800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C4D8A4CB-5B80-4332-BCBC-DA18AD94D215"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:business_access_points:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78149144-CCF5-4C71-B22D-45261C4ACABC",
"versionEndExcluding": "10.1.1.0",
"versionStartIncluding": "10.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70B4ABE1-4F2F-478A-AA0E-8F293105FEBE",
"versionEndExcluding": "16.12.4a"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1B9ED0E5-CB20-4106-9CF2-8EB587B33543"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2B0E620C-8E09-4F7C-A326-26013173B993"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FF93F1C8-669F-4ECB-8D81-ECDA7B550175"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2E0BA345-B7D7-4975-9199-4DC7875BBFD0"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4E9EA95F-4E39-4D9C-8A84-D1F6014A4A40"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EA0BC769-C244-41BD-BE80-E67F4E1CDDA4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:aironet_access_point_software:8.10\\(1.255\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D40D1D98-F662-4C7D-AEC8-C106209D7848"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:aironet_1850e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "24E47788-9B54-42C5-AD83-428B22674575"
},
{
"criteria": "cpe:2.3:h:cisco:aironet_1850i:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A333CD0B-4729-4E64-8B52-A3F5138F5B70"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}