{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-20846", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2021-11-02T13:28:29.179Z", "datePublished": "2024-11-15T15:32:38.495Z", "dateUpdated": "2024-11-15T16:41:07.934Z"}, "containers": {"cna": {"title": "Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Cisco&nbsp;Discovery Protocol implementation for Cisco&nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco&nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco&nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco&nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco&nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco&nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). &nbsp;Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see ."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2", "name": "cisco-sa-xr-cdp-wnALzvT2"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt", "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt</a></p><p>This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see <a href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\">Cisco&nbsp;Event Response: September 2022 Semiannual Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6", "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6</a></p><p>This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see <a href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\">Cisco&nbsp;Event Response: September 2022 Semiannual Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication"}], "exploits": [{"lang": "en", "value": "The Cisco\u00a0PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.\r\n\r\nThe Cisco\u00a0PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-xr-cdp-wnALzvT2", "discovery": "EXTERNAL", "defects": ["CSCwb23263"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "cwe", "cweId": "CWE-120"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"version": "6.5.3", "status": "affected"}, {"version": "6.5.29", "status": "affected"}, {"version": "6.5.1", "status": "affected"}, {"version": "6.6.1", "status": "affected"}, {"version": "6.5.2", "status": "affected"}, {"version": "6.5.92", "status": "affected"}, {"version": "6.5.15", "status": "affected"}, {"version": "6.6.2", "status": "affected"}, {"version": "7.0.1", "status": "affected"}, {"version": "6.6.25", "status": "affected"}, {"version": "6.5.26", "status": "affected"}, {"version": "6.6.11", "status": "affected"}, {"version": "6.5.25", "status": "affected"}, {"version": "6.5.28", "status": "affected"}, {"version": "6.5.93", "status": "affected"}, {"version": "6.6.12", "status": "affected"}, {"version": "6.5.90", "status": "affected"}, {"version": "7.0.0", "status": "affected"}, {"version": "7.1.1", "status": "affected"}, {"version": "7.0.90", "status": "affected"}, {"version": "6.6.3", "status": "affected"}, {"version": "6.7.1", "status": "affected"}, {"version": "7.0.2", "status": "affected"}, {"version": "7.1.15", "status": "affected"}, {"version": "7.2.0", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "7.1.2", "status": "affected"}, {"version": "6.7.2", "status": "affected"}, {"version": "7.0.11", "status": "affected"}, {"version": "7.0.12", "status": "affected"}, {"version": "7.0.14", "status": "affected"}, {"version": "7.1.25", "status": "affected"}, {"version": "6.6.4", "status": "affected"}, {"version": "7.2.12", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.1.3", "status": "affected"}, {"version": "6.7.3", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "6.7.4", "status": "affected"}, {"version": "6.5.31", "status": "affected"}, {"version": "7.3.15", "status": "affected"}, {"version": "7.3.16", "status": "affected"}, {"version": "6.8.1", "status": "affected"}, {"version": "7.4.15", "status": "affected"}, {"version": "6.5.32", "status": "affected"}, {"version": "7.3.2", "status": "affected"}, {"version": "7.5.1", "status": "affected"}, {"version": "7.4.16", "status": "affected"}, {"version": "7.3.27", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.5.2", "status": "affected"}, {"version": "7.6.15", "status": "affected"}, {"version": "7.5.12", "status": "affected"}, {"version": "7.3.3", "status": "affected"}, {"version": "6.8.2", "status": "affected"}, {"version": "7.3.4", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "6.7.35", "status": "affected"}, {"version": "6.9.1", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-11-15T15:32:38.495Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-15T16:40:55.507077Z", "id": "CVE-2022-20846", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T16:41:07.934Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-20846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-15T16:40:55.507077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T16:41:03.485Z"}}], "cna": {"title": "Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow Vulnerability", "source": {"defects": ["CSCwb23263"], "advisory": "cisco-sa-xr-cdp-wnALzvT2", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "6.5.29"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.5.92"}, {"status": "affected", "version": "6.5.15"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "6.5.26"}, {"status": "affected", "version": "6.6.11"}, {"status": "affected", "version": "6.5.25"}, {"status": "affected", "version": "6.5.28"}, {"status": "affected", "version": "6.5.93"}, {"status": "affected", "version": "6.6.12"}, {"status": "affected", "version": "6.5.90"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "6.7.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.15"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "6.7.2"}, {"status": "affected", "version": "7.0.11"}, {"status": "affected", "version": "7.0.12"}, {"status": "affected", "version": "7.0.14"}, {"status": "affected", "version": "7.1.25"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.2.12"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.1.3"}, {"status": "affected", "version": "6.7.3"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "6.7.4"}, {"status": "affected", "version": "6.5.31"}, {"status": "affected", "version": "7.3.15"}, {"status": "affected", "version": "7.3.16"}, {"status": "affected", "version": "6.8.1"}, {"status": "affected", "version": "7.4.15"}, {"status": "affected", "version": "6.5.32"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.4.16"}, {"status": "affected", "version": "7.3.27"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.6.15"}, {"status": "affected", "version": "7.5.12"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "6.8.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "6.7.35"}, {"status": "affected", "version": "6.9.1"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco\u00a0PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.\r\n\r\nThe Cisco\u00a0PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2", "name": "cisco-sa-xr-cdp-wnALzvT2"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt", "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt</a></p><p>This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see <a href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\">Cisco&nbsp;Event Response: September 2022 Semiannual Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6", "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6</a></p><p>This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see <a href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\">Cisco&nbsp;Event Response: September 2022 Semiannual Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Cisco&nbsp;Discovery Protocol implementation for Cisco&nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco&nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco&nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco&nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco&nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco&nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). &nbsp;Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see ."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-120", "description": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-11-15T15:32:38.495Z"}}}, "cveMetadata": {"cveId": "CVE-2022-20846", "state": "PUBLISHED", "dateUpdated": "2024-11-15T16:41:07.934Z", "dateReserved": "2021-11-02T13:28:29.179Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-11-15T15:32:38.495Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "A vulnerability in the Cisco&nbsp;Discovery Protocol implementation for Cisco&nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco&nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco&nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco&nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco&nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco&nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). &nbsp;Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco&nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see ."}, {"lang": "es", "value": "Una vulnerabilidad en la implementaci\u00f3n del protocolo Cisco Discovery para el software Cisco IOS XR podr\u00eda permitir que un atacante adyacente no autenticado haga que el proceso del protocolo Cisco Discovery se vuelva a cargar en un dispositivo afectado. Esta vulnerabilidad se debe a un desbordamiento del b\u00fafer de pila en ciertos mensajes del protocolo Cisco Discovery. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un paquete malicioso del protocolo Cisco Discovery a un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir que el atacante provoque un desbordamiento de pila, lo que podr\u00eda hacer que el proceso del protocolo Cisco Discovery se vuelva a cargar en el dispositivo. Los bytes que se pueden escribir en el desbordamiento del b\u00fafer est\u00e1n restringidos, lo que limita la ejecuci\u00f3n remota de c\u00f3digo. Nota: el protocolo Cisco Discovery es un protocolo de capa 2. Para aprovechar esta vulnerabilidad, un atacante debe estar en el mismo dominio de difusi\u00f3n que el dispositivo afectado (capa 2 adyacente). Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que aborden esta vulnerabilidad. Este aviso es parte de la versi\u00f3n de septiembre de 2022 de la publicaci\u00f3n conjunta de avisos de seguridad del software Cisco IOS XR. Para obtener una lista completa de los avisos y los enlaces a ellos, consulte."}], "id": "CVE-2022-20846", "lastModified": "2024-11-21T06:43:40.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2024-11-15T16:15:23.120", "references": [{"source": "ykramarz@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt"}, {"source": "ykramarz@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6"}, {"source": "ykramarz@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}