CVE-2022-20856 — Improper Control of a Resource Through its Lifetime in Cisco IOS XE Software

CWE-664 — Improper Control of a Resource Through its Lifetime4 documents4 sources

Severity

7.5HIGHNVD

CNA8.6

EPSS

0.9%

top 23.59%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XE Software Cisco IOS XE

Timeline

PublishedSep 30

Latest updateOct 1

Description

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error and improper management of resources related to the handling of CAPWAP Mobility messages. An attacker could exploit this vulnerability by sending crafte…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_softwaren/a

▶NVDcisco/ios_xe17.3.4c

🔴Vulnerability Details

GHSA

GHSA-q52w-4rvg-f65r: A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller↗2022-10-01

▶

CVEList

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service Vulnerability↗2022-09-30

▶

📋Vendor Advisories

Cisco

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service Vulnerability↗2022-09-28

▶