CVE-2022-20922 Denial of service in Cisco Cyber Vision
Remote attackers can cause denial of service or bypass security policies by sending high-rate SMB2 packets to Cisco devices using Snort 3.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-20922?
CVE-2022-20922 is a medium-severity denial of service vulnerability in Cisco Secure Firewall Threat Defense, published on 10 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper management of system resources when the Snort detection engine is processing SMB2 traffic. An attacker could exploit these vulnerabilities by sending a high rate of certain types of SMB2 packets through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process, resulting in a DoS condition. Note: When the snort preserve-connection option is enabled for the Snort detection engine, a successful exploit could also allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network. The snort preserve-connection setting is enabled by default. See the Details ["#details"] section of this advisory for more information. Note: Only products that have Snort 3 configured are affected. Products that are configured with Snort 2 are not affected.
Weakness: CWE-244
Which versions are affected by CVE-2022-20922?
It affects 3 products.
Products include Cisco Cyber Vision, Cisco Secure Firewall Threat Defense, Cisco Umbrella Virtual Appliance.
How do I fix CVE-2022-20922?
No fix has been published for CVE-2022-20922 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-20922 being exploited?
There is no known exploitation of CVE-2022-20922 in the wild and no public exploit code.
Other vulnerabilities in Cisco Secure Firewall Threat Defense
- CVE-2022-20685 Multiple Cisco Products Snort Modbus Denial of Service Vulnerability
- CVE-2026-20005 Denial of service in Cisco Cyber Vision
- CVE-2026-20053 Memory corruption in Cisco Cyber Vision
- CVE-2026-20054 Denial of service in Cisco Cyber Vision
- CVE-2026-20057 Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability
Sources
Also known as GHSA-jp5m-rmjh-rg7r.