Pierluigi Paganini February 06, 2020

A set of vulnerabilities in the Cisco Discovery Protocol (CDP) exposes tens of millions of devices to the risk of cyber attacks.

Researchers at IoT security firm Armis discovered a set of five serious vulnerabilities in the implementation of the Cisco Discovery Protocol (CDP) protocol. The experts tracked the set as CDPwn and warned that the issues could be exploited by attackers to take complete control of vulnerable devices.

“Armis has discovered five critical, zero-day vulnerabilities in various implementations of the Cisco Discovery Protocol (CDP) that can allow remote attackers to completely take over devices  without any user interaction. CDP is a Cisco proprietary Layer 2 (Data Link Layer) network protocol that is used to discover information about locally attached Cisco equipment.” reads the advisory published by Armis. “CDP is implemented in virtually all Cisco products including switches, routers, IP phones and cameras. All those devices ship from the factory with CDP enabled by default. The CERT Coordination Center has also issued an advisory.”

Cisco Discovery Protocol (CDP) is a proprietary Data Link Layer protocol developed by Cisco Systems in 1994 that is used to share information about other directly connected Cisco equipment, including the operating system version and IP address.

The protocol is used by Cisco network equipment (switches, routers), IP phones, and cameras.

Four vulnerabilities of the CDPwn set are remote code execution (RCE) vulnerabilities, the other one is a Denial of Service (DoS) flaw. An attacker could exploit the flaws only once it has gained access to the target network, then he would send specially crafted CDP packets to the targeted device.

An attacker could exploit the RCE vulnerabilities to break the network segmentation, to exfiltrate corporate network traffic traversing through an organization’s switches and routers, to gain access to additional devices by leveraging man-in-the-middle attacks by intercepting and altering traffic on the corporate switch, to exfiltrate sensitive information such as phone calls from devices like IP phones and video feeds from IP cameras

The code execution vulnerabilities affect the NX-OS, IOS XR, IP phone, and IP camera implementations, while the DoS flaw impact the FXOS, IOS XR and NX-OS implementations of CDP.

Armis researchers presented several attack scenarios, such as breaking of network segmentation, data exfiltration from devices like IP phones and cameras

Cisco has published security dvisories and released patches to address the issues. The flaws were tracked as CVE-2020-3120, CVE-2020-3119, CVE-2020-3118, CVE-2020-3111 and CVE-2020-3110 an received a high severity rating.

Pierluigi Paganini

(SecurityAffairs – cdpwn cdp flaws, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]