CVE-2022-20919CWE-248

Cisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service Vulnerability

High · published September 30, 2022

CVSS v3.1
8.6
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient input validation during processing of CIP packets. An attacker could exploit this vulnerability by sending a malformed CIP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01207 · 68.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2022-09-30T18:46Z
EPSS history
Timeline
  • 30 SEP 18:46Z
    Cisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service Vulnerability
    cvelistv5