PT-2022-2303 · Cisco · Cisco Sd-Wan Vedge Routers

Published 2022-04-13 · Updated 2023-05-22 · CVE-2022-20717

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vEdge Routers (affected versions not specified)

Description The issue is related to insufficient memory management in the NETCONF process of Cisco SD-WAN vEdge Routers, which can lead to an uncontrolled memory consumption. An attacker could exploit this by sending large amounts of malicious traffic to an affected device, potentially causing the device to run out of memory and resulting in a denial of service (DoS) condition. This could allow the attacker to cause the device to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-770

Related Identifiers

BDU:2022-02488

CVE-2022-20717

Affected Products

Cisco Sd-Wan Vedge Routers

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vedge-dos-jerVm4bB · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02488 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20717 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20717 · Vendor Advisory
• https://t.me/cibsecurity/40865 · Telegram Post