PT-2021-7070 · Cisco · Cisco Ios Xe Wireless Controller+1
Published
2021-11-02
·
Updated
2022-04-27
·
CVE-2022-20684
CVSS v3.1
7.4
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family (affected versions not specified)
Description
A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients could allow an unauthenticated, adjacent attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition on the device. This issue is due to a lack of input validation of the information used to generate an SNMP trap related to a wireless client connection event. An attacker could exploit this vulnerability by sending an 802.1x packet with crafted parameters during the wireless authentication setup phase of a connection.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, consider restricting access to the SNMP trap generation feature to minimize the risk of exploitation.
Avoid using crafted parameters in 802.1x packets during the wireless authentication setup phase of a connection until the issue is resolved.
DoS
Integer Overflow
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Ios Xe Wireless Controller
Cisco Ios Xe