Multiple vulnerabilities in Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches

Published: 2022-04-15

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-20661 CVE-2022-20731
CWE-ID	CWE-489
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Cisco IOS Operating systems & Components / Operating system Catalyst Digital Building Series Switches Other software / Other software solutions Catalyst Micro Switches Other software / Other software solutions Cisco Boot Loader Other software / Other software solutions
Vendor	Cisco Systems, Inc

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Active Debug Code

EUVDB-ID: #VU62353

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20661

CWE-ID: CWE-489 - Active Debug Code

Exploit availability: No

Description

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected devices have an internal Cisco development boot loader that includes capabilities beyond those present in a normal boot loader. An attacker with physical access can break into the ROM monitor (ROMMON) during the boot cycle and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco IOS: 15.2(8)E - 15.2.7 E

Catalyst Digital Building Series Switches: All versions

Catalyst Micro Switches: All versions

Cisco Boot Loader: 15.2(7r)E2

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdb-cmicr-vulns-KJjFtNb

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Active Debug Code

EUVDB-ID: #VU62354