CVE-2022-20767: Cisco Firepower Threat Defense Software DNS Enforcement Denial of Service Vulnerability
A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement rule. An attacker could exploit this vulnerability by sending crafted UDP packets through an affected device to force a buildup of UDP connections. A successful exploit could allow the attacker to cause traffic that is going through the affected device to be dropped, resulting in a DoS condition. Note: This vulnerability only affects Cisco FTD devices that are running Snort 3.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-20767?
CVE-2022-20767 is a vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
How does CVE-2022-20767 affect Cisco Firepower Threat Defense Software?
CVE-2022-20767 affects Cisco Firepower Threat Defense Software by causing a denial of service (DoS) condition on an affected device.
What is the severity of CVE-2022-20767?
The severity of CVE-2022-20767 is high, with a severity value of 7.5.
How can an attacker exploit CVE-2022-20767?
An attacker can exploit CVE-2022-20767 by sending specially crafted DNS traffic to an affected device.
Is there a fix for CVE-2022-20767?
Yes, Cisco has released a software update to address the vulnerability. Please refer to the Cisco Security Advisory for more information.