cdpwn – Millions of devices at risk due to flaws in implementations of Cisco Discovery Protocol (CDP)

A set of vulnerabilities in the Cisco Discovery Protocol (CDP) exposes tens of millions of devices to the risk of cyber attacks.

Researchers at IoT security firm Armis discovered a set of five serious vulnerabilities in the implementation of the Cisco Discovery Protocol (CDP) protocol. The experts tracked the set as CDPwn and warned that the issues could be exploited by attackers to take complete control of vulnerable devices.

“Armis has discovered five critical, zero-day vulnerabilities in various implementations of the Cisco Discovery Protocol (CDP) that can allow remote attackers to completely take over devices without any user interaction. CDP is a Cisco proprietary Layer 2 (Data Link Layer) network protocol that is used to discover information about locally attached Cisco equipment.” reads the advisory published by Armis. “CDP is implemented in virtually all Cisco products including switches, routers, IP phones and cameras. All those devices ship from the factory with CDP enabled by default. The CERT Coordination Center has also issued an advisory.”

Cisco Discovery Protocol (CDP) is a proprietary Data Link Layer protocol developed by Cisco Systems in 1994 that is used to share information about other directly connected Cisco equipment, including the operating system version and IP address.

The protocol is used by Cisco network equipment (switches, routers), IP phones, and cameras.

Four vulnerabilities of the CDPwn set are remote code execution (RCE) vulnerabilities, the other one is a Denial of Service (DoS) flaw. An attacker could exploit the flaws only once it has gained access to the target network, then he would send specially crafted CDP packets to the targeted device.

An attacker could exploit the RCE vulnerabilities to break the network segmentation, to exfiltrate corporate network traffic traversing through an organization’s switches and routers, to gain access to additional devices by leveraging man-in-the-middle attacks by intercepting and altering traffic on the corporate switch, to exfiltrate sensitive information such as phone calls from devices like IP phones and video feeds from IP cameras

The code execution vulnerabilities affect the NX-OS, IOS XR, IP phone, and IP camera implementations, while the DoS flaw impact the FXOS, IOS XR and NX-OS implementations of CDP.

Armis researchers presented several attack scenarios, such as breaking of network segmentation, data exfiltration from devices like IP phones and cameras

Cisco has published security dvisories and released patches to address the issues. The flaws were tracked as CVE-2020-3120, CVE-2020-3119, CVE-2020-3118, CVE-2020-3111 and CVE-2020-3110 an received a high severity rating.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – cdpwn cdp flaws, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.