CVE-2022-20937 Denial of service in Cisco Identity Services Engine Software

Medium 5.3 Published 3 Nov 2022 Updated 3 Aug 2024

An unauthenticated remote attacker can cause significant delays in RADIUS authentications by exploiting insufficient resource management in Cisco ISE.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-20937?

CVE-2022-20937 is a medium-severity denial of service vulnerability in Cisco Identity Services Engine, published on 3 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This vulnerability is due to insufficient management of system resources. An attacker could exploit this vulnerability by taking actions that cause Cisco ISE Software to receive specific RADIUS traffic. A successful and sustained exploit of this vulnerability could allow the attacker to cause reduced performance of the affected device, resulting in significant delays to RADIUS authentications. There are workarounds that address this vulnerability.

Weakness: CWE-400, CWE-410

Which versions are affected by CVE-2022-20937?

It affects 1 product.

Products include Cisco Identity Services Engine.

How do I fix CVE-2022-20937?

No fix has been published for CVE-2022-20937 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-20937 being exploited?

There is no known exploitation of CVE-2022-20937 in the wild and no public exploit code.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-pmp2-f627-c94j.