CVE-2022-20937 — Insufficient Resource Pool in Cisco Identity Services Engine

CWE-410 — Insufficient Resource PoolCWE-400 — Uncontrolled Resource Consumption4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 39.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services EngineCisco Identity Services Engine Software
Timeline
PublishedNov 4

Description

A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This vulnerability is due to insufficient management of system resources. An attacker could exploit this vulnerability by taking actions that cause Cisco ISE Software to receive specific RADIUS traffic. A successful and sustained exploit of this vulnerability could allow the attacker…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-pmp2-f627-c94j: A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote att↗2022-11-04
▶
CVEList
CVE-2022-20937: A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote att↗2022-11-03
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Software Resource Exhaustion Vulnerability↗2022-11-02
▶
CVE-2022-20937 — Insufficient Resource Pool in Cisco | cvebase