CVE-2022-20653: Cisco Email Security Appliance DNS Verification Denial of Service Vulnerability
First published: Thu Feb 17 2022(Updated: )
A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in DNS name resolution by the affected software. An attacker could exploit this vulnerability by sending specially formatted email messages that are processed by an affected device. A successful exploit could allow the attacker to cause the device to become unreachable from management interfaces or to process additional email messages for a period of time until the device recovers, resulting in a DoS condition. Continued attacks could cause the device to become completely unavailable, resulting in a persistent DoS condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AsyncOS | <13.0.3 | |
| Cisco AsyncOS | >=13.5.0<13.5.4.102 | |
| Cisco AsyncOS | >=14.0<14.0.2.020 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Email Security Appliance vulnerability?
The vulnerability ID for this Cisco Email Security Appliance vulnerability is CVE-2022-20653.
What is the severity level of CVE-2022-20653?
CVE-2022-20653 has a severity level of high.
What is the affected software for CVE-2022-20653?
The affected software for CVE-2022-20653 is Cisco AsyncOS Software for Cisco Email Security Appliance.
What is the impact of CVE-2022-20653?
CVE-2022-20653 can allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
Is there a fix available for CVE-2022-20653?
Yes, please refer to the Cisco Security Advisory for instructions on how to fix CVE-2022-20653.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/title
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco asyncos
- version/cisco asyncos/13.5.0
- version/cisco asyncos/14.0