PT-2021-7002 · Cisco · Cisco Unified Communications Manager+1

Published 2021-11-02 · Updated 2022-05-03 · CVE-2022-20804

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) (affected versions not specified)

Description The issue is related to the implementation of the Cisco Discovery Protocol in the affected systems, which is associated with insufficient checking of unusual or exceptional states. This could allow a remote attacker to cause a denial of service (DoS) condition by continuously sending certain Cisco Discovery Protocol packets to an affected device, resulting in a kernel panic on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2022-02887

CVE-2022-20804

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Session Management Edition

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-dos-zHS9X9kD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20804 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20804 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02887 · Security Note
• https://cybersecurity-help.cz/vdb/SB2022042132 · Note
• https://vuldb.com/?id.198308 · Note
• https://t.me/cibsecurity/41253 · Telegram Post