CVE-2022-20856

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error and improper management of resources related to the handling of CAPWAP Mobility messages. An attacker could exploit this vulnerability by sending crafted CAPWAP Mobility packets to an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device. This would cause the device to reload, resulting in a DoS condition.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-mob-dos-342YAc6J	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:ios_xe:17.3.4c:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:catalyst_9800:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-40:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-80:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-cl:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-l:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-l-c:-:::::::*
	cpe:2.3:h:cisco:catalyst_9800-l-f:-:::::::*

History

27 Oct 2022, 15:47

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-09-30 19:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-20856

Mitre link : CVE-2022-20856

CVE.ORG link : CVE-2022-20856

JSON object : View

Products Affected

cisco

catalyst_9800-40
ios_xe
catalyst_9800-80
catalyst_9800-cl
catalyst_9800-l-c
catalyst_9800-l
catalyst_9800
catalyst_9800-l-f

CWE

NVD-CWE-Other CWE-664

Improper Control of a Resource Through its Lifetime

{"id": "CVE-2022-20856", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2022-09-30T19:15:13.223", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-mob-dos-342YAc6J", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-664"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error and improper management of resources related to the handling of CAPWAP Mobility messages. An attacker could exploit this vulnerability by sending crafted CAPWAP Mobility packets to an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device. This would cause the device to reload, resulting in a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en el procesamiento de los mensajes de Movilidad de Control y Aprovisionamiento de Puntos de Acceso Inal\u00e1mbricos (CAPWAP) en el Software Controlador Inal\u00e1mbrico Cisco IOS XE para la Familia Catalyst 9000 podr\u00eda permitir a un atacante remoto no autenticado causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad es debido a un error l\u00f3gico y a una administraci\u00f3n inapropiada de los recursos relacionados con el manejo de los mensajes de movilidad CAPWAP. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de paquetes CAPWAP Mobility dise\u00f1ados a un dispositivo afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante agotar los recursos del dispositivo afectado. Esto causar\u00eda una recarga del dispositivo, resultando en una condici\u00f3n de DoS"}], "lastModified": "2023-11-07T03:43:08.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:17.3.4c:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CEF022B-271F-4017-B74B-82748D5EBA01"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A48E6CF0-7A3B-4D11-8D02-0CD38F2420E9"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B9ED0E5-CB20-4106-9CF2-8EB587B33543"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2B0E620C-8E09-4F7C-A326-26013173B993"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF93F1C8-669F-4ECB-8D81-ECDA7B550175"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E0BA345-B7D7-4975-9199-4DC7875BBFD0"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4E9EA95F-4E39-4D9C-8A84-D1F6014A4A40"}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EA0BC769-C244-41BD-BE80-E67F4E1CDDA4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}