PT-2021-7229 · Cisco · Cisco Ios Xe

Published 2021-11-02 · Updated 2023-06-27 · CVE-2022-20683

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers (affected versions not specified)

Description A vulnerability in the Application Visibility and Control (AVC-FNF) feature could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to insufficient packet verification for traffic inspected by the AVC feature. An attacker could exploit this by sending crafted packets from the wired network to a wireless client, resulting in the crafted packets being processed by the wireless controller. A successful exploit could allow the attacker to cause a crash and reload of the affected device, resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-124

CWE-787

Related Identifiers

BDU:2022-03923

CVE-2022-20683

Affected Products

Cisco Ios Xe

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03923 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20683 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/678258 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20683 · Security Note
• https://vuldb.com/?id.197443 · Note
• https://cybersecurity-help.cz/vdb/SB2022041411 · Note