CVE-2023-20262 Denial of service in Cisco SD-WAN Solution

Medium 5.3 Published 27 Sep 2023 Updated 2 Aug 2024

Unauthenticated remote attackers can crash the SSH service on Cisco Catalyst SD-WAN Manager, causing a denial of service for SSH access only.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-20262?

CVE-2023-20262 is a medium-severity denial of service vulnerability in Cisco Catalyst Sd-Wan Manager, published on 27 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a DoS condition for SSH access only. This vulnerability does not prevent the system from continuing to function, and web UI access is not affected. This vulnerability is due to insufficient resource management when an affected system is in an error condition. An attacker could exploit this vulnerability by sending malicious traffic to the affected system. A successful exploit could allow the attacker to cause the SSH process to crash and restart, resulting in a DoS condition for the SSH service.

Weakness: CWE-399

Which versions are affected by CVE-2023-20262?

It affects 2 products.

Products include Cisco Catalyst Sd-Wan Manager, Cisco Sd-Wan Vmanage.

How do I fix CVE-2023-20262?

No fix has been published for CVE-2023-20262 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-20262 being exploited?

There is no known exploitation of CVE-2023-20262 in the wild and no public exploit code.

All Cisco Catalyst Sd-Wan Manager vulnerabilities

Sources

Also known as GHSA-h2rg-8hq7-x2qc.