PT-2023-2212 · Cisco · Cisco Packet Data Network Gateway

Publicado 2023-04-05 · Atualizado 2023-04-11 · CVE-2023-20051

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Packet Data Network Gateway (PGW) (affected versions not specified)

Description A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP traffic from being processed over an IPsec connection. This issue is due to the VPP improperly handling a malformed packet. An attacker could exploit this by sending a malformed Encapsulating Security Payload (ESP) packet over an IPsec connection. A successful exploit could allow the attacker to stop ICMP traffic over an IPsec connection and cause a denial of service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-400

CWE-20

Identificadores relacionados

BDU:2023-01960

CVE-2023-20051

Produtos afetados

Cisco Packet Data Network Gateway

Referências · 6

• https://t.me/cibsecurity/61490 · Publicação no Telegram
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pdng-dos-KmzwEy2Q · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20051 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023040658 · Nota
• https://bdu.fstec.ru/vul/2023-01960 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-20051 · Aviso do Fabricante