Cisco Aironet Access Points Ethernet Wired Clients Denial of Service Vulnerability
Priority LOW 33CWE-476Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.
Summary
A vulnerability in the Ethernet packet handling of Cisco Aironet Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting as a wired client to the Ethernet interface of an affected device and sending a series of specific packets within a short time frame. A successful exploit could allow the attacker to cause a NULL pointer access that results in a reload of the affected device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Aironet Access Point Software | all versions | — | No fix listed | CNA |
- Cisco Aironet Access Point Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:wireless_lan_controller:*:*:*:*:*:*:*:* | 8.6 to before 8.10.105.0 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:aironet_1542d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1542i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1562d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1562e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1562i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1815:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1830e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1830i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:wireless_lan_controller:*:*:*:*:*:*:*:* Versions 8.6 to before 8.10.105.0 Vulnerable ·Cisco
- cpe:2.3:h:cisco:aironet_1542d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1542i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1562d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1562e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1562i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1815:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1830e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1830i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:aironet_1840:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1850e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_1850i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_2800e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_2800i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_3800e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_3800i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_3800p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:aironet_4800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:a:cisco:business_access_points:*:*:*:*:*:*:*:* | 10.0 to before 10.1.1.0 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:* | before 16.12.4a | Vulnerable | Cisco |
| cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:a:cisco:aironet_access_point_software:8.10\(1.255\):*:*:*:*:*:*:* | 8.10(1.255) | Vulnerable | Cisco |
- cpe:2.3:h:cisco:aironet_1840:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1850e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_1850i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_2800e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_2800i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_3800e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_3800i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_3800p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:aironet_4800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:a:cisco:business_access_points:*:*:*:*:*:*:*:* Versions 10.0 to before 10.1.1.0 Vulnerable ·Cisco
- cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:* Versions before 16.12.4a Vulnerable ·Cisco
- cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:a:cisco:aironet_access_point_software:8.10\(1.255\):*:*:*:*:*:*:* Versions 8.10(1.255) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-3552
- 2026-10-03 Alias added: GHSA-hr95-cqm5-95mg
References
More Cisco Access Points vulnerabilities
- TI-2020-03104 Cisco Aironet Access Points UDP Flooding Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2020-03103 Cisco Aironet Access Point Authentication Flood Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2019-01540 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability CVSS 3.1HIGH 7.4
- TI-2018-00400 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability CVSS 3.0HIGH 7.4
Sources
- CVE-2020-3552 · CVE Program
- CVE-2020-3552 · NVD
- FIRST EPSS
- GHSA-hr95-cqm5-95mg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences