CVE-2014-3341

The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

Affected products

Cisco Nx-Os, Cisco Nexus

Cisco Nx-os

≤ 7.0\(3\)n1\(1\), 5.0\(2\)n1\(1\), 5.0\(2\)n2\(1\), 5.0\(2\)n2\(1a\), 5.0\(3\)n1\(1c\), 5.0\(3\)n2\(1\), 5.0\(3\)n2\(2\), 5.0\(3\)n2\(2a\), 5.0\(3\)n2\(2b\), 5.1\(3\)n1\(1\), 5.1\(3\)n1\(1a\), 5.1\(3\)n2\(1\), 5.1\(3\)n2\(1a\), 5.1\(3\)n2\(1b\), 5.1\(3\)n2\(1c\), 5.2\(1\)n1\(1\), 5.2\(1\)n1\(1a\), 5.2\(1\)n1\(1b\), 5.2\(1\)n1\(2\), 5.2\(1\)n1\(2a\), 5.2\(1\)n1\(3\), 5.2\(1\)n1\(4\), 5.2\(1\)n1\(5\), 5.2\(1\)n1\(6\), 5.2\(1\)n1\(7\), 5.2\(1\)n1\(8\), 5.2\(1\)n1\(8a\), 6.0\(2\)n1\(2\), 6.0\(2\)n1\(2a\), 6.0\(2\)n2\(1\), 6.0\(2\)n2\(1b\), 6.0\(2\)n2\(2\), 6.0\(2\)n2\(3\), 6.0\(2\)n2\(4\), 6.0\(2\)n2\(5\), 7.0\(0\)n1\(1\), 7.0\(1\)n1\(1\), 7.0\(2\)n1\(1\)

Cisco Nexus 5000

All versions

Cisco Nexus 5010

All versions

Fix

Available

CVSS 2.0

5.0 MEDIUM

EPSS

4.7% (91th percentile)

Weakness

CWE-200

NVD status

Modified

Published

2014-08-19