CVE-2022-20697

15.04.2022, 15:15

A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this vulnerability by sending a large number of HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
cisco	CNA	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 62%

Vendor	Product	Version
cisco	ios	15.1\(3\)svr1
cisco	ios	15.1\(3\)svr2
cisco	ios	15.1\(3\)svr3
cisco	ios	15.1\(3\)svs
cisco	ios	15.1\(3\)svs1
cisco	ios	15.1\(3\)svt1
cisco	ios	15.1\(3\)svt2
cisco	ios	15.1\(3\)svt3
cisco	ios	15.1\(3\)svu1
cisco	ios	15.1\(3\)svu2
cisco	ios	15.1\(3\)svu10
cisco	ios	15.1\(3\)svv1
cisco	ios	15.2\(7\)e3
cisco	ios	15.2\(7\)e3a
cisco	ios	15.2\(7\)e3k
cisco	ios	15.2\(7\)e4
cisco	ios	15.2\(8\)e
cisco	ios	15.2\(234k\)e
cisco	ios	15.3\(3\)jk100
cisco	ios	15.3\(3\)jpj8
cisco	ios	15.9\(3\)m2
cisco	ios	15.9\(3\)m2a
cisco	ios	15.9\(3\)m3
cisco	ios	15.9\(3\)m3a
cisco	ios	15.9\(3\)m3b
cisco	ios	15.9\(3\)m4
cisco	ios_xe	3.11.3ae:ae
cisco	ios_xe	3.11.3e:e
cisco	ios_xe	3.11.4e:e

𝑥

= Vulnerable software versions

Common Weakness Enumeration

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-dos-svOdkdBS