Heap Inspection in Cisco Systems, Inc products - CVE-2022-20943
Published: November 11, 2022
Vulnerability identifier: #VU69245
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20943
CWE-ID: CWE-244
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of system resources in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
Meraki MX Security Appliances
FirePOWER Services
Umbrella Secure Internet Gateway
Cyber Vision
Cisco Firewall Threat Defense (FTD)
FirePOWER Services
Umbrella Secure Internet Gateway
Cyber Vision
Cisco Firewall Threat Defense (FTD)
How to mitigate CVE-2022-20943
Install updates from vendor's website.
Meraki MX Security Appliances - addressed in versions 16.6.7, 17.11.1, 18.1.3
Cyber Vision - update to 4.1.2
Cyber Vision - update to 4.1.2