CVE Vulnerabilities

CVE-2022-20697

Insufficient Control Flow Management

Published: Apr 15, 2022 | Modified: Nov 21, 2024
CVSS 3.x
8.6
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:L/Au:S/C:N/I:N/A:C
RedHat/V2
RedHat/V3
Ubuntu

A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this vulnerability by sending a large number of HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Weakness

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Affected Software

Name Vendor Start Version End Version
Ios Cisco 15.1(3)svr1 (including) 15.1(3)svr1 (including)
Ios Cisco 15.1(3)svr2 (including) 15.1(3)svr2 (including)
Ios Cisco 15.1(3)svr3 (including) 15.1(3)svr3 (including)
Ios Cisco 15.1(3)svs (including) 15.1(3)svs (including)
Ios Cisco 15.1(3)svs1 (including) 15.1(3)svs1 (including)
Ios Cisco 15.1(3)svt1 (including) 15.1(3)svt1 (including)
Ios Cisco 15.1(3)svt2 (including) 15.1(3)svt2 (including)
Ios Cisco 15.1(3)svt3 (including) 15.1(3)svt3 (including)
Ios Cisco 15.1(3)svu1 (including) 15.1(3)svu1 (including)
Ios Cisco 15.1(3)svu2 (including) 15.1(3)svu2 (including)
Ios Cisco 15.1(3)svu10 (including) 15.1(3)svu10 (including)
Ios Cisco 15.1(3)svv1 (including) 15.1(3)svv1 (including)
Ios Cisco 15.2(7)e3 (including) 15.2(7)e3 (including)
Ios Cisco 15.2(7)e3a (including) 15.2(7)e3a (including)
Ios Cisco 15.2(7)e3k (including) 15.2(7)e3k (including)
Ios Cisco 15.2(7)e4 (including) 15.2(7)e4 (including)
Ios Cisco 15.2(8)e (including) 15.2(8)e (including)
Ios Cisco 15.2(234k)e (including) 15.2(234k)e (including)
Ios Cisco 15.3(3)jk100 (including) 15.3(3)jk100 (including)
Ios Cisco 15.3(3)jpj8 (including) 15.3(3)jpj8 (including)
Ios Cisco 15.9(3)m2 (including) 15.9(3)m2 (including)
Ios Cisco 15.9(3)m2a (including) 15.9(3)m2a (including)
Ios Cisco 15.9(3)m3 (including) 15.9(3)m3 (including)
Ios Cisco 15.9(3)m3a (including) 15.9(3)m3a (including)
Ios Cisco 15.9(3)m3b (including) 15.9(3)m3b (including)
Ios Cisco 15.9(3)m4 (including) 15.9(3)m4 (including)
Ios_xe Cisco 3.11.3ae (including) 3.11.3ae (including)
Ios_xe Cisco 3.11.3e (including) 3.11.3e (including)
Ios_xe Cisco 3.11.4e (including) 3.11.4e (including)

References