Sd WanApplication · Cisco

CVE-2020-3375

CRITICAL · 9.8 CVSS v3.1 Published 2020-07-31

Fix available

A fix is available. Upgrade to 18.4.5 / 19.2.2 or later.

See remediation →

100/100

Remediation priority · Urgent

Remotely reachable No privileges Zero-click

Official description

NVD · unedited

A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access, make changes to the system that they are not authorized to make, and execute commands on an affected system with privileges of the root user.

Technical summary

dbcve analysis · high confidence

A buffer overflow vulnerability in Cisco SD-WAN Solution Software stems from insufficient input validation. An unauthenticated, remote attacker can exploit this by sending crafted traffic to an affected device, potentially gaining unauthorized access, making unauthorized system changes, and executing commands with root privileges.

MitigationApply the vendor-supplied patch for CVE-2020-3375 from Cisco's security advisory; prioritize patching internet-facing SD-WAN edge devices given the CVSS 9.8 severity and remote exploitability.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions

NVD · CPE data

Sd WanApplication

Affected:<= 18.3.0>= 18.4.0, < 18.4.5>= 19.2.0, < 19.2.2>= 19.3.0, < 20.1.1

Ios Xe Sd WanOperating system

Affected:<= 16.9.0>= 16.12.0, <= 16.12.4>= 17.2.0, <= 17.2.1

CVSS breakdown

From the vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected?

dbcve checks

Work through these to decide whether this CVE applies to you.

Identify the software platform

Run 'show version' or 'show sd-wan version' to confirm the device runs Cisco SD-WAN or Cisco IOS XE SD-WAN software

Affected if The device is not running Cisco SD-WAN or IOS XE SD-WAN software - this vulnerability only affects those platforms
Retrieve the installed software version

Execute 'show version' and locate the version number in the output (for SD-WAN it typically appears as something like 18.x.x or 19.x.x; for IOS XE it appears as 16.x.x, 17.x.x, etc.)

Affected if The exact version cannot be determined from the device output
Compare version against affected ranges for Cisco SD-WAN

If running Cisco SD-WAN software, check if the version falls within: <=18.3.0, >=18.4.0 and <18.4.5, >=19.2.0 and <19.2.2, or >=19.3.0 and <20.1.1

Affected if The installed version matches any of these ranges: <=18.3.0, 18.4.0-18.4.4, 19.2.0-19.2.1, or 19.3.0-20.1.0
Compare version against affected ranges for Cisco IOS XE SD-WAN

If running Cisco IOS XE SD-WAN, check if the version falls within: <=16.9.0, >=16.12.0 and <=16.12.4, or >=17.2.0 and <=17.2.1

Affected if The installed version matches any of these ranges: <=16.9.0, 16.12.0-16.12.4, or 17.2.0-17.2.1
Verify SD-WAN feature is enabled

Run 'show sd-wan' or 'show sd-wan running-config' to confirm the SD-WAN feature and tunnels are configured and active on the device

Affected if SD-WAN is not configured or not active - the vulnerability requires SD-WAN to be enabled as the flaw is in the SD-WAN component

The device is affected if it runs Cisco SD-WAN or IOS XE SD-WAN software AND the installed version falls within the affected ranges AND the SD-WAN feature is enabled on the device.

Generated from the published advisory. Verify against your own configuration.

Remediation

dbcve · scoped

Upgrade available Upgrade to 18.4.5 / 19.2.2 / 20.1.1 or later

Fixed in 18.4.519.2.220.1.1

Interim mitigation

Apply the vendor-supplied patch for CVE-2020-3375 from Cisco's security advisory; prioritize patching internet-facing SD-WAN edge devices given the CVSS 9.8 severity and remote exploitability.

Recommended fix Moderate confidence

SD-WAN: 18.4.5+, 19.2.2+, or 20.1.1+ | IOS XE SD-WAN: 16.12.5+ or 17.3.0+

1. Identify the current installed version of Cisco SD-WAN or IOS XE SD-WAN using 'show version' command
2. Determine the appropriate upgrade path based on your current version branch (18.3.x, 18.4.x, 19.2.x, 19.3.x, 20.1.x for SD-WAN; or 16.9.x, 16.12.x, 17.2.x for IOS XE SD-WAN)
3. For SD-WAN: upgrade to version 18.4.5 or later, 19.2.2 or later, or 20.1.1 or later
4. For IOS XE SD-WAN: upgrade to version 16.12.5 or later, or 17.3.0 or later
5. Download the appropriate Cisco SD-WAN software from Cisco.com software download center
6. Follow standard Cisco SD-WAN upgrade procedures: backup configuration, upload new image, reboot the device
7. Verify the upgrade was successful and the device is functioning normally

Caveat Review Cisco release notes for each target version for any configuration or feature changes before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Sd Wan Scoped from the published advisory

Consultation6.0 h
Implementation12.0 h
Testing10.0 h
Review / QA6.0 h

34.0 hours of engineering $5,940

Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $9,504.

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2020-3375 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

tools.cisco.comVendor Advisory
nvd.nist.govNVD record

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-3375 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2020-3375?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsUpgrade to 18.4.5 / 19.2.2 or later

Severity 9.8 Critical

Exploit likelihood EPSS, next 30 days 3.9%

Affects: Sd Wan

Remediation

A high-priority fix

Fix this in Sd Wan 34 hrs · High

Typical engagement from $5,940

Get a fix See the full breakdown ↓

A high-priority vulnerability. Send your environment and a specialist will scope CVE-2020-3375 and return a fixed quote and timeline.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

Check your environment

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

Affected products & versions

CVSS breakdown

Am I affected?

Remediation

References