Vulnerabilities > CVE-2022-20678 - Improper Handling of Exceptional Conditions vulnerability in Cisco IOS XE

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cisco

CWE-755

NVD

Published: 2022-04-15

Updated: 2024-11-21

Summary

A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of certain TCP segments. An attacker could exploit this vulnerability by sending a stream of crafted TCP traffic at a high rate through an interface of an affected device. That interface would need to have AppNav interception enabled. A successful exploit could allow the attacker to cause the device to reload.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE 16.9.6 Cisco IOS XE 16.12.4 Cisco IOS XE 16.12.5 Cisco IOS XE 17.3.3	4
Application	Cisco Cisco Catalyst 8000V Edge - Cisco Cloud Services Router 1000V -	2
Hardware	Cisco Cisco 1100 4G Integrated Services Router - Cisco 1100 6G Integrated Services Router - Cisco 1101 Integrated Services Router - Cisco 1109 Integrated Services Router - Cisco 1111X Integrated Services Router - Cisco 111X Integrated Services Router - Cisco 1120 Integrated Services Router - Cisco 1131 Integrated Services Router - Cisco 1160 Integrated Services Router - Cisco 4221 Integrated Services Router - Cisco 4331 Integrated Services Router - Cisco 4431 Integrated Services Router - Cisco 4461 Integrated Services Router - Cisco ASR 1001 X - Cisco ASR 1002 X - Cisco Catalyst 8300 1N1S 4T2X - Cisco Catalyst 8300 1N1S 6T - Cisco Catalyst 8300 2N2S 4T2X - Cisco Catalyst 8300 2N2S 6T - Cisco Catalyst 8500 - Cisco Catalyst 8500 4QC - Cisco Catalyst 8500L -	22

Common Weakness Enumeration (CWE)

CWE-755 - Improper Handling of Exceptional Conditions

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References