CVE-2022-20697: Cisco IOS and IOS XE Software Web Services Denial of Service Vulnerability
First published: Fri Apr 15 2022(Updated: )
A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this vulnerability by sending a large number of HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | =15.1\(3\)svr1 | |
| Cisco IOS | =15.1\(3\)svr2 | |
| Cisco IOS | =15.1\(3\)svr3 | |
| Cisco IOS | =15.1\(3\)svs | |
| Cisco IOS | =15.1\(3\)svs1 | |
| Cisco IOS | =15.1\(3\)svt1 | |
| Cisco IOS | =15.1\(3\)svt2 | |
| Cisco IOS | =15.1\(3\)svt3 | |
| Cisco IOS | =15.1\(3\)svu1 | |
| Cisco IOS | =15.1\(3\)svu2 | |
| Cisco IOS | =15.1\(3\)svu10 | |
| Cisco IOS | =15.1\(3\)svv1 | |
| Cisco IOS | =15.2\(7\)e3 | |
| Cisco IOS | =15.2\(7\)e3a | |
| Cisco IOS | =15.2\(7\)e3k | |
| Cisco IOS | =15.2\(7\)e4 | |
| Cisco IOS | =15.2\(8\)e | |
| Cisco IOS | =15.2\(234k\)e | |
| Cisco IOS | =15.3\(3\)jk100 | |
| Cisco IOS | =15.3\(3\)jpj8 | |
| Cisco IOS | =15.9\(3\)m2 | |
| Cisco IOS | =15.9\(3\)m2a | |
| Cisco IOS | =15.9\(3\)m3 | |
| Cisco IOS | =15.9\(3\)m3a | |
| Cisco IOS | =15.9\(3\)m3b | |
| Cisco IOS | =15.9\(3\)m4 | |
| Cisco IOS XE | =3.11.3ae | |
| Cisco IOS XE | =3.11.3e | |
| Cisco IOS XE | =3.11.4e |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Cisco IOS and IOS XE vulnerability?
The vulnerability ID is CVE-2022-20697.
What is the severity rating of the CVE-2022-20697 vulnerability?
The severity rating of CVE-2022-20697 is high.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by causing a denial of service (DoS) condition through improper resource management in the HTTP server code.
Which versions of Cisco IOS Software and Cisco IOS XE Software are affected by this vulnerability?
The affected versions include Cisco IOS 15.1(3)svr1, 15.1(3)svr2, 15.1(3)svr3, 15.1(3)svs, 15.1(3)svs1, and more. Please refer to the Cisco Security Advisory for the full list.
Is there a fix available for CVE-2022-20697 vulnerability?
Yes, Cisco has released software updates to address this vulnerability. Please refer to the Cisco Security Advisory for the available patches.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/title
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco ios
- version/cisco ios/15.1\(3\)svr1
- version/cisco ios/15.1\(3\)svr2
- version/cisco ios/15.1\(3\)svr3
- version/cisco ios/15.1\(3\)svs
- version/cisco ios/15.1\(3\)svs1
- version/cisco ios/15.1\(3\)svt1
- version/cisco ios/15.1\(3\)svt2
- version/cisco ios/15.1\(3\)svt3
- version/cisco ios/15.1\(3\)svu1
- version/cisco ios/15.1\(3\)svu2
- version/cisco ios/15.1\(3\)svu10
- version/cisco ios/15.1\(3\)svv1
- version/cisco ios/15.2\(7\)e3
- version/cisco ios/15.2\(7\)e3a
- version/cisco ios/15.2\(7\)e3k
- version/cisco ios/15.2\(7\)e4
- version/cisco ios/15.2\(8\)e
- version/cisco ios/15.2\(234k\)e
- version/cisco ios/15.3\(3\)jk100
- version/cisco ios/15.3\(3\)jpj8
- version/cisco ios/15.9\(3\)m2
- version/cisco ios/15.9\(3\)m2a
- version/cisco ios/15.9\(3\)m3
- version/cisco ios/15.9\(3\)m3a
- version/cisco ios/15.9\(3\)m3b
- version/cisco ios/15.9\(3\)m4
- canonical/cisco ios xe
- version/cisco ios xe/3.11.3ae
- version/cisco ios xe/3.11.3e
- version/cisco ios xe/3.11.4e