CVE-2020-3147
Cisco Small Business Switches Denial of Service Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. This vulnerability affects firmware releases prior than 1.3.7.18
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cisco Small Business Switches Denial of Service Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. This vulnerability affects firmware releases prior than 1.3.7.18
- Record
CVE-2020-3147- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2020-24418
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. This vulnerability affects firmware releases prior than 1.3.7.18
- Record
EUVD-2020-24418- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fch4-wxg7-rpqw No score
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated,...
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. This vulnerability affects firmware releases prior than 1.3.7.18
- Record
GHSA-fch4-wxg7-rpqw- Updated
- 2026-11-02
NVD
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. This vulnerability affects firmware releases prior than 1.3.7.18
- Record
CVE-2020-3147- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- cisco small business 300 series managed switches
- cisco sf300-08 firmware
- cisco sf300-24 firmware
- cisco sf300-24mp firmware
- cisco sf300-24p firmware
- cisco sf300-24pp firmware
- cisco sf300-48 firmware
- cisco sf300-48p firmware
- cisco sf300-48pp firmware
- cisco sf302-08 firmware
- cisco sf302-08mp firmware
- cisco sf302-08mpp firmware
Show 46 moreShow less
- cisco sf302-08p firmware
- cisco sf302-08pp firmware
- cisco sf500-24 firmware
- cisco sf500-24p firmware
- cisco sf500-48 firmware
- cisco sf500-48p firmware
- cisco sg200-08 firmware
- cisco sg200-08p firmware
- cisco sg200-10fp firmware
- cisco sg200-18 firmware
- cisco sg200-24 firmware
- cisco sg200-24fp firmware
- cisco sg200-24p firmware
- cisco sg200-26 firmware
- cisco sg200-26fp firmware
- cisco sg200-26p firmware
- cisco sg200-48 firmware
- cisco sg200-48p firmware
- cisco sg200-50 firmware
- cisco sg200-50fp firmware
- cisco sg200-50p firmware
- cisco sg300-10 firmware
- cisco sg300-10mp firmware
- cisco sg300-10mpp firmware
- cisco sg300-10p firmware
- cisco sg300-10pp firmware
- cisco sg300-10sfp firmware
- cisco sg300-20 firmware
- cisco sg300-28 firmware
- cisco sg300-28mp firmware
- cisco sg300-28p firmware
- cisco sg300-28pp firmware
- cisco sg300-52 firmware
- cisco sg300-52mp firmware
- cisco sg300-52p firmware
- cisco sg500-28 firmware
- cisco sg500-28mpp firmware
- cisco sg500-28p firmware
- cisco sg500-52 firmware
- cisco sg500-52mp firmware
- cisco sg500-52p firmware
- cisco sg500x-24 firmware
- cisco sg500x-24p firmware
- cisco sg500x-48 firmware
- cisco sg500x-48p firmware
- cisco sg500xg-8f8t firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-3147 is a high vulnerability (CVSS 8.6) in Cisco Small Business 300 Series Managed Switches, published January 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. No source names a fixed version.