PT-2022-1642 · Cisco · Cisco Staros+1

Published 2022-02-17 · Updated 2022-02-25 · CVE-2022-20750

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software (affected versions not specified)

Description A vulnerability in the checkpoint manager implementation could allow an unauthenticated, remote attacker to cause the checkpoint manager process to restart upon receipt of malformed TCP data. This is due to improper input validation of an ingress TCP packet. An attacker could exploit this by sending crafted TCP data to the affected application, potentially causing a denial of service (DoS) condition due to the checkpoint manager process restarting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-00890

CVE-2022-20750

Affected Products

Cisco Redundancy Configuration Manager

Cisco Staros

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rcm-tcp-dos-2Wh8XjAQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20750 · Security Note
• https://bdu.fstec.ru/vul/2022-00890 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20750 · Vendor Advisory
• https://t.me/cibsecurity/37663 · Telegram Post