CVE-2022-20847 : A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Co

A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of DHCP messages. An attacker could exploit this vulnerability by sending malicious DHCP messages to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Published 2022-09-30 19:15:12

Updated 2023-06-27 18:22:16

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-20847

Cisco » Ios Xe » Version: 17.3.3
cpe:2.3:a:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 9800 » Version: N/A
When used together with: Cisco » Catalyst 9800-40 » Version: N/A
When used together with: Cisco » Catalyst 9800-80 » Version: N/A
When used together with: Cisco » Catalyst 9800-cl » Version: N/A
When used together with: Cisco » Catalyst 9800-l » Version: N/A
When used together with: Cisco » Catalyst 9800-l-c » Version: N/A
When used together with: Cisco » Catalyst 9800-l-f » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-20847

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-20847

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	3.9	4.0	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-20847

CWE-399

Assigned by: ykramarz@cisco.com (Secondary)
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-20847

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dhcp-dos-76pCjPxK

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family DHCP Processing Denial of Service Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-20847

Products affected by CVE-2022-20847

Exploit prediction scoring system (EPSS) score for CVE-2022-20847

CVSS scores for CVE-2022-20847

CWE ids for CVE-2022-20847

References for CVE-2022-20847