CVE-2022-20756

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 06-04-2022 09:15

Last modified: - 14-04-2022 05:32

Total changes: - 2

Description

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by attempting to authenticate to a network or a service where the access server is using Cisco ISE as the RADIUS server. A successful exploit could allow the attacker to cause Cisco ISE to stop processing RADIUS requests, causing authentication/authorization timeouts, which would then result in legitimate requests being denied access. Note: To recover the ability to process RADIUS packets, a manual restart of the affected Policy Service Node (PSN) is required. See the Details section for more information.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.5

Base score

3.9

3.6

Exploitability score

Impact score

Verification logic

vendor=cisco AND product=identity_services_engine AND version=2.2.0 AND update=patch17

vendor=cisco AND product=identity_services_engine AND version=2.4.0 AND update=patch12

vendor=cisco AND product=identity_services_engine AND version=2.4.0 AND update=patch13

vendor=cisco AND product=identity_services_engine AND version=2.4.0 AND update=patch14

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch10

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch5

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch6

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch7

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch8

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch9

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch2

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch3

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch4

vendor=cisco AND product=identity_services_engine AND version=2.7.0.356 AND update=patch1

vendor=cisco AND product=identity_services_engine AND version=3.0.0 AND update=-

vendor=cisco AND product=identity_services_engine AND version=3.1 AND update=-

Reference

20220302 Cisco Identity Services Engine RADIUS Service Denial of Service Vulnerability-Vendor Advisory

Keywords

CVE-2022-20756

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-20756

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures