High severity · published Aug 25, 2022
CVE-2022-20824
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input validation of specific values that are within a Cisco Discovery Protocol message. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or cause the Cisco Discovery Protocol process to crash and restart multiple times, which would cause the affected device to reload, resulting in a DoS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M9
Mds 9506 Firmware · Cisco
All versions, or not specified · source: NVD
M9
Mds 9513 Firmware · Cisco
All versions, or not specified · source: NVD
M9
Mds 9706 Firmware · Cisco
All versions, or not specified · source: NVD
M9
Mds 9710 Firmware · Cisco
All versions, or not specified · source: NVD
M9
Mds 9718 Firmware · Cisco
All versions, or not specified · source: NVD
N1
Nexus 1000v Firmware · Cisco
All versions, or not specified · source: NVD
N3
Nexus 3016 Firmware · Cisco
All versions, or not specified · source: NVD
N3
Nexus 3016q Firmware · Cisco
All versions, or not specified · source: NVD
N3
Nexus 3048 Firmware · Cisco
All versions, or not specified · source: NVD
N3
Nexus 3064 Firmware · Cisco
All versions, or not specified · source: NVD
N3
Nexus 3064-32t Firmware · Cisco
All versions, or not specified · source: NVD
N3
Nexus 3064-t Firmware · Cisco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-20824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-20824
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220923-0001/
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cdp-dos-ce-wWvPucC9
