PT-2022-5527 · Cisco · Cisco Ise

Published 2022-11-02 · Updated 2024-01-25 · CVE-2022-20937

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) Software (affected versions not specified)

Description A vulnerability in the feature that monitors RADIUS requests could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This issue is due to insufficient management of system resources. An attacker could exploit this vulnerability by taking actions that cause Cisco ISE Software to receive specific RADIUS traffic, potentially causing reduced performance of the affected device and resulting in significant delays to RADIUS authentications.

Recommendations There are workarounds that address this vulnerability. As a temporary workaround, consider restricting the reception of specific RADIUS traffic to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-410

Related Identifiers

BDU:2022-06856

CVE-2022-20937

Affected Products

Cisco Ise

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-sec-atk-dos-zw5RCUYp · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20937 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20937 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-sec-atk-dos-zw5RCUYp · Note
• https://t.me/cvenotify/68707 · Telegram Post