PT-2022-6088 · Cisco · Cisco Ios Xe

Published 2022-09-28 · Updated 2022-10-13 · CVE-2022-20837

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This issue is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this by sending crafted DNS packets through the affected device performing NAT for DNS packets, resulting in a denial of service (DoS) condition. The vulnerability can only be exploited by sending IPv4 TCP packets, not IPv6 traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2023-00026

CVE-2022-20837

Affected Products

Cisco Ios Xe

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alg-dos-KU9Z8kFX · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00026 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20837 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alg-dos-KU9Z8kFX · Vendor Advisory
• https://t.me/cibsecurity/51070 · Telegram Post