Vulnerability Description
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. An attacker could exploit this vulnerability by crafting a malicious request and sending it to the affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to crash and restart, resulting in the failure of the established SSL VPN connections and forcing remote users to initiate a new VPN connection and re-authenticate. A sustained attack could prevent new SSL VPN connections from being established. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully without requiring manual intervention. Cisco Meraki has released software updates that address this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Meraki Mx64 Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx64 | - |
| Cisco | Meraki Mx64W Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx64W | - |
| Cisco | Meraki Mx65 Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx65 | - |
| Cisco | Meraki Mx65W Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx65W | - |
| Cisco | Meraki Mx67 Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx67 | - |
| Cisco | Meraki Mx67Cw Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx67Cw | - |
| Cisco | Meraki Mx67W Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx67W | - |
| Cisco | Meraki Mx68 Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx68 | - |
| Cisco | Meraki Mx68Cw Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx68Cw | - |
| Cisco | Meraki Mx68W Firmware | >= 16.2.0, < 16.16.6 |
| Cisco | Meraki Mx68W | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mVendor Advisory
FAQ
What is CVE-2022-20933?
CVE-2022-20933 is a vulnerability with a CVSS score of 8.6 (HIGH). A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) ...
How severe is CVE-2022-20933?
CVE-2022-20933 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-20933?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Meraki Mx64 Firmware, Cisco Meraki Mx64, Cisco Meraki Mx64W Firmware, Cisco Meraki Mx64W, Cisco Meraki Mx65 Firmware.