PT-2022-6270 · Cisco · Cisco Meraki Z3 Teleworker Gateway+2

Published 2022-10-19 · Updated 2022-10-31 · CVE-2022-20933

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices (affected versions not specified)

Description A vulnerability in the Cisco AnyConnect VPN server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This issue is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. An attacker could exploit this by crafting a malicious request and sending it to the affected device, causing the Cisco AnyConnect VPN server to crash and restart. This results in the failure of established SSL VPN connections, forcing remote users to initiate a new VPN connection and re-authenticate. A sustained attack could prevent new SSL VPN connections from being established. When the attack traffic stops, the Cisco AnyConnect VPN server recovers without requiring manual intervention.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-234

Related Identifiers

BDU:2023-00690

CVE-2022-20933

Affected Products

Cisco Anyconnect Vpn Server

Cisco Meraki Mx

Cisco Meraki Z3 Teleworker Gateway

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20933 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00690 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20933 · Security Note
• https://t.me/cibsecurity/52108 · Telegram Post