8.6

CVE-2022-20697

Cisco IOS and IOS XE Software Web Services Denial of Service Vulnerability

A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this vulnerability by sending a large number of HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ios Version 15.1(3)svr1
Cisco ≫ Ios Version 15.1(3)svr2
Cisco ≫ Ios Version 15.1(3)svr3
Cisco ≫ Ios Version 15.1(3)svs
Cisco ≫ Ios Version 15.1(3)svs1
Cisco ≫ Ios Version 15.1(3)svt1
Cisco ≫ Ios Version 15.1(3)svt2
Cisco ≫ Ios Version 15.1(3)svt3
Cisco ≫ Ios Version 15.1(3)svu1
Cisco ≫ Ios Version 15.1(3)svu2
Cisco ≫ Ios Version 15.1(3)svu10
Cisco ≫ Ios Version 15.1(3)svv1
Cisco ≫ Ios Version 15.2(7)e3
Cisco ≫ Ios Version 15.2(7)e3a
Cisco ≫ Ios Version 15.2(7)e3k
Cisco ≫ Ios Version 15.2(7)e4
Cisco ≫ Ios Version 15.2(8)e
Cisco ≫ Ios Version 15.2(234k)e
Cisco ≫ Ios Version 15.3(3)jk100
Cisco ≫ Ios Version 15.3(3)jpj8
Cisco ≫ Ios Version 15.9(3)m2
Cisco ≫ Ios Version 15.9(3)m2a
Cisco ≫ Ios Version 15.9(3)m3
Cisco ≫ Ios Version 15.9(3)m3a
Cisco ≫ Ios Version 15.9(3)m3b
Cisco ≫ Ios Version 15.9(3)m4
Cisco ≫ Ios Xe Version 3.11.3ae
Cisco ≫ Ios Xe Version 3.11.3e
Cisco ≫ Ios Xe Version 3.11.4e
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.14% 0.637
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NIST 6.8 8 6.9
AV:N/AC:L/Au:S/C:N/I:N/A:C
Cisco PSIRT 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-691 Insufficient Control Flow Management

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

CWE-772 Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-dos-svOdkdBS
Vendor Advisory