PT-2023-2212 · Cisco · Cisco Packet Data Network Gateway

Published 2023-04-05 · Updated 2023-04-11 · CVE-2023-20051

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Packet Data Network Gateway (PGW) (affected versions not specified)

Description A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP traffic from being processed over an IPsec connection. This issue is due to the VPP improperly handling a malformed packet. An attacker could exploit this by sending a malformed Encapsulating Security Payload (ESP) packet over an IPsec connection. A successful exploit could allow the attacker to stop ICMP traffic over an IPsec connection and cause a denial of service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2023-01960

CVE-2023-20051

Affected Products

Cisco Packet Data Network Gateway

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pdng-dos-KmzwEy2Q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20051 · Security Note
• https://bdu.fstec.ru/vul/2023-01960 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20051 · Vendor Advisory
• https://t.me/cibsecurity/61490 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023040658 · Note