Vulnerability Description
A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. This vulnerability cannot be exploited by sending IPv6 traffic.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | - |
| Cisco | Asr 1000-Esp100-X | - |
| Cisco | Asr 1000-Esp200-X | - |
| Cisco | Catalyst 8500 | - |
| Cisco | Catalyst 8500-4Qc | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aVendor Advisory
FAQ
What is CVE-2022-20837?
CVE-2022-20837 is a vulnerability with a CVSS score of 8.6 (HIGH). A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to c...
How severe is CVE-2022-20837?
CVE-2022-20837 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-20837?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco Asr 1000-Esp100-X, Cisco Asr 1000-Esp200-X, Cisco Catalyst 8500, Cisco Catalyst 8500-4Qc.