Millions of devices at risk due to flaws in implementations of Cisco Discovery Protocol (CDP)

A set of vulnerabilities in the Cisco Discovery Protocol (CDP) exposes tens of millions of devices to the risk of cyber attacks.

Researchers at IoT security firm Armis discovered a set of five serious vulnerabilities in the implementation of the Cisco Discovery Protocol (CDP) protocol. The experts tracked the set as CDPwn and warned that the issues could be exploited by attackers to take complete control of vulnerable devices.

“Armis has discovered five critical, zero-day vulnerabilities in various implementations of the Cisco Discovery Protocol (CDP) that can allow remote attackers to completely take over devices  without any user interaction. CDP is a Cisco proprietary Layer 2 (Data Link Layer) network protocol that is used to discover information about locally attached Cisco equipment.” reads the advisory published by Armis. “CDP is implemented in virtually all Cisco products including switches, routers, IP phones and cameras. All those devices ship from the factory with CDP enabled by default. The CERT Coordination Center has also issued an advisory.”

Cisco Discovery Protocol (CDP)is a proprietary Data Link Layer protocol developed by Cisco Systems in 1994 that is used to share information about other directly connected Cisco equipment, including the operating system version and IP address.

The protocol is used by Cisco network equipment (switches, routers), IP phones, and cameras.

Four vulnerabilities of the CDPwn set are remote code execution (RCE) vulnerabilities, the other one is a Denial of Service (DoS) flaw. An attacker could exploit the flaws only once it has gained access to the target network, then he would send specially crafted CDP packets to the targeted device.

An attacker could exploit the RCE vulnerabilities to break the network segmentation, to exfiltrate corporate network traffic traversing through an organization’s switches and routers, to gain access to additional devices by leveraging man-in-the-middle attacks by intercepting and altering traffic on the corporate switch, to exfiltrate sensitive information such as phone calls from devices like IP phones and video feeds from IP cameras

The code execution vulnerabilities affect the NX-OS, IOS XR, IP phone, and IP camera implementations, while the DoS flaw impact the FXOS, IOS XR and NX-OS implementations of CDP.

Armis researchers presented several attack scenarios, such as breaking of network segmentation, data exfiltration from devices like IP phones and cameras

Cisco has published security dvisories and released patches to address the issues. The flaws were tracked as CVE-2020-3120, CVE-2020-3119, CVE-2020-3118, CVE-2020-3111 and CVE-2020-3110 an received a high severity rating.

Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase