CVE-2022-20933 : A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. An attacker could exploit this vulnerability by crafting a malicious request and sending it to the affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to crash and restart, resulting in the failure of the established SSL VPN connections and forcing remote users to initiate a new VPN connection and re-authenticate. A sustained attack could prevent new SSL VPN connections from being established. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully without requiring manual intervention. Cisco Meraki has released software updates that address this vulnerability.

Published 2022-10-26 15:15:15

Updated 2022-10-31 17:40:05

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-20933

Cisco » Meraki Mx64 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx64_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx64 » Version: N/A
Cisco » Meraki Mx64 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx64_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx64 » Version: N/A
Cisco » Meraki Mx64w Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx64w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx64w » Version: N/A
Cisco » Meraki Mx64w Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx64w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx64w » Version: N/A
Cisco » Meraki Mx67 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx67_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx67 » Version: N/A
Cisco » Meraki Mx67 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx67_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx67 » Version: N/A
Cisco » Meraki Mx67w Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx67w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx67w » Version: N/A
Cisco » Meraki Mx67w Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx67w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx67w » Version: N/A
Cisco » Meraki Mx68 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx68_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx68 » Version: N/A
Cisco » Meraki Mx68 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx68_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx68 » Version: N/A
Cisco » Meraki Mx68cw Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx68cw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx68cw » Version: N/A
Cisco » Meraki Mx68cw Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx68cw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx68cw » Version: N/A
Cisco » Meraki Mx68w Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx68w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx68w » Version: N/A
Cisco » Meraki Mx68w Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx68w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx68w » Version: N/A
Cisco » Meraki Mx100 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx100 » Version: N/A
Cisco » Meraki Mx100 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx100 » Version: N/A
Cisco » Meraki Mx84 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx84_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx84 » Version: N/A
Cisco » Meraki Mx84 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx84_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx84 » Version: N/A
Cisco » Meraki Mx250 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx250 » Version: N/A
Cisco » Meraki Mx250 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx250 » Version: N/A
Cisco » Meraki Mx450 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx450 » Version: N/A
Cisco » Meraki Mx450 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx450 » Version: N/A
Cisco » Meraki Mx65w Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx65w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx65w » Version: N/A
Cisco » Meraki Mx65w Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx65w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx65w » Version: N/A
Cisco » Meraki Mx67cw Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx67cw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx67cw » Version: N/A
Cisco » Meraki Mx67cw Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx67cw_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx67cw » Version: N/A
Cisco » Meraki Z3 Firmware » Version: N/A
cpe:2.3:o:cisco:meraki_z3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Z3 » Version: N/A
Cisco » Meraki Z3c Firmware » Version: N/A
cpe:2.3:o:cisco:meraki_z3c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Z3c » Version: N/A
Cisco » Meraki Mx65 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx65_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx65 » Version: N/A
Cisco » Meraki Mx65 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx65_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx65 » Version: N/A
Cisco » Meraki Mx75 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx75_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx75 » Version: N/A
Cisco » Meraki Mx75 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx75_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx75 » Version: N/A
Cisco » Meraki Mx85 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx85_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx85 » Version: N/A
Cisco » Meraki Mx85 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx85_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx85 » Version: N/A
Cisco » Meraki Mx95 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx95_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx95 » Version: N/A
Cisco » Meraki Mx95 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx95_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx95 » Version: N/A
Cisco » Meraki Mx105 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx105_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx105 » Version: N/A
Cisco » Meraki Mx105 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx105_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx105 » Version: N/A
Cisco » Meraki Mx400 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx400 » Version: N/A
Cisco » Meraki Mx400 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx400 » Version: N/A
Cisco » Meraki Mx600 Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_mx600_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx600 » Version: N/A
Cisco » Meraki Mx600 Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_mx600_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Mx600 » Version: N/A
Cisco » Meraki Vmx Firmware
Versions from including (>=) 16.2.0 and before (<) 16.16.6
cpe:2.3:o:cisco:meraki_vmx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Vmx » Version: N/A
Cisco » Meraki Vmx Firmware
Versions from including (>=) 17.0.0 and before (<) 17.10.1
cpe:2.3:o:cisco:meraki_vmx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Meraki Vmx » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-20933

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-20933

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	3.9	4.0	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High
8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	3.9	4.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-20933

CWE-234 Failure to Handle Missing Parameter

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2022-20933

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf

Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-20933

Products affected by CVE-2022-20933

Exploit prediction scoring system (EPSS) score for CVE-2022-20933

CVSS scores for CVE-2022-20933

CWE ids for CVE-2022-20933

References for CVE-2022-20933