Cisco IOS XR CDP Heap Overflow DoS Vulnerability (CVE-2022-20846) Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Type: Cisco IOS XR Software Cisco Discovery Protocol Denial of Service Vulnerability - Vulnerability ID: cisco-sa-xr-cdp-wnALzvT2 - CVE Number: CVE-2022-20846 - CWE Number: CWE-120 - CVSS Score: Base 4.3 2. Affected Products: - Cisco IOS XR Software - Specific versions: 5.2.2 and later 3. Vulnerability Impact: - An unauthenticated adjacent attacker can exploit this vulnerability by sending malicious Cisco Discovery Protocol packets, causing the Cisco Discovery Protocol process on the affected device to reload. - The vulnerability is due to a heap buffer overflow in the Cisco Discovery Protocol implementation. 4. Remediation: - Cisco has released software updates to address this vulnerability. - No workarounds are available to bypass this vulnerability. 5. Affected Software Versions: - Cisco IOS XR Software versions 5.2.2 and later 6. Workarounds: - No workarounds are available for this vulnerability. - Customers who do not use the Cisco Discovery Protocol feature can reduce the attack surface by globally disabling it or disabling it on individual interfaces. 7. Affected Product List: - Cisco IOS Software - Cisco IOS XE Software - Cisco NX-OS Software 8. Source: - The vulnerability was reported by Qian Chen (@cq674350529) from the Codesafe Team at Legendsec, QIANXIN Group. 9. Related Links: - Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2 This information helps users understand the nature of the vulnerability, the affected products and software versions, and how to remediate or mitigate the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IOS XR CDP Heap Overflow DoS Vulnerability (CVE-2022-20846) Advisory