PT-2022-3761 · Cisco · Cisco 1000 Series Connected Grid Router+1

Burt Welsh · Published 2022-04-13 · Updated 2022-04-25 · CVE-2022-20761

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco 1000 Series Connected Grid Router (CGR1K) (affected versions not specified)

Description A vulnerability in the integrated wireless access point (AP) packet processing could allow an unauthenticated, adjacent attacker to cause a denial of service condition on an affected device. This issue is due to insufficient input validation of received traffic. An attacker could exploit this vulnerability by sending crafted traffic to an affected device, causing the integrated AP to stop processing traffic and resulting in a denial of service condition. It may be necessary to manually reload the device to restore AP operation.

Recommendations For the Cisco 1000 Series Connected Grid Router (CGR1K), update to a version that includes the software updates released by Cisco to address this vulnerability. As a temporary workaround, consider manually reloading the CGR1K to restore AP operation after a successful exploit. There are no other workarounds that address this vulnerability.

Fix

DoS

RCE

Weakness Enumeration

CWE-248

CWE-20

Related Identifiers

BDU:2022-04549

CVE-2022-20761

Affected Products

Cisco 1000 Series Connected Grid Router

Cisco Ios

References · 4

• https://osv.dev/vulnerability/CVE-2022-20761 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cgr1k-ap-dos-mSZR4QVh · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04549 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20761 · Security Note