PT-2022-2655 · Cisco · Cisco Embedded Wireless Controller With Catalyst Access Points

Miroslav Popovic · Published 2022-04-13 · Updated 2022-04-25 · CVE-2022-20622

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Cisco Embedded Wireless Controller with Catalyst Access Points Software (affected versions not specified)

Description The issue is related to improper rate limiting of IP packets to the management interface, which could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The device may experience performance degradation in traffic processing or high CPU usage prior to the unexpected reload. An attacker could exploit this by sending a steady stream of IP traffic at a high rate to the management interface of the affected device. This could also lead to resource exhaustion, specifically memory depletion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2022-03128

CVE-2022-20622

Affected Products

Cisco Embedded Wireless Controller With Catalyst Access Points

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ip-flood-dos-6hxxENVQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20622 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20622 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03128 · Security Note