Improper Handling of Length Parameter Inconsistency in Cisco Systems, Inc products - CVE-2022-20870

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU67735

Improper Handling of Length Parameter Inconsistency in Cisco Systems, Inc products - CVE-2022-20870

Published: September 29, 2022


Vulnerability identifier: #VU67735
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20870
CWE-ID: CWE-130
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation of IPv4 traffic in the egress MPLS packet processing function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

Catalyst 3650 Series Switches
Catalyst 3850 Series Switches
Catalyst 9300 Series Switches
Catalyst 9400 Series Switches
Catalyst 9500 Series Switches
Catalyst 9600 Series Switches
Cisco IOS XE

How to mitigate CVE-2022-20870

Install updates from vendor's website.

Cisco IOS XE - addressed in versions 16.12.6, 16.12.7, 16.12.8, 17.3.5, 17.3.5b, 17.3.6, 17.6.1z, 17.6.2, 17.6.3, 17.6.3a, 17.6.4, 17.7.1, 17.7.1a, 17.7.2, 17.8.1, 17.8.1a, 17.9.1, 17.9.1a

External References

Related Security Bulletins