Resource exhaustion in Cisco AsyncOS for Cisco Email Security Appliance - CVE-2022-20960
Published: November 4, 2022
Vulnerability identifier: #VU68968
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20960
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper handling of certain TLS connections processed by the device. A remote attacker can cause the device to drop new TLS email messages that come from the associated email servers.
Affected software
Cisco AsyncOS for Cisco Email Security Appliance
How to mitigate CVE-2022-20960
Install updates from vendor's website.
Cisco AsyncOS for Cisco Email Security Appliance - addressed in versions 14.2.1-015, 14.3.0-020