#VU62335 Input validation error in Cisco Systems, Inc products - CVE-2022-20726

Vulnerability identifier: #VU62335

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-20726

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
800 Series Industrial Integrated Services Routers
Industrial Ethernet 4000 Series Switches
800 Series Integrated Services Routers
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Cisco ASR 1000 Series Aggregation Services Routers
Catalyst 9x00 Series Switches
Catalyst IE3400 Rugged Series
Embedded Services 3300 Series Switches
IR510 WPAN Industrial Routers
IC3000 Industrial Compute Gateway
CGR1000 Compute Modules
Cisco IOx
Cisco IOS XE
Cisco IOS

Software vendor:
Cisco Systems, Inc

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient error handling of socket operations in the Cisco IOx application hosting environment. A remote attacker can send a specially crafted TCP traffic and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj