CVE-2022-20937
First published: Thu Nov 03 2022(Updated: )
A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This vulnerability is due to insufficient management of system resources. An attacker could exploit this vulnerability by taking actions that cause Cisco ISE Software to receive specific RADIUS traffic. A successful and sustained exploit of this vulnerability could allow the attacker to cause reduced performance of the affected device, resulting in significant delays to RADIUS authentications. There are workarounds that address this vulnerability.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <2.7.0 | |
| Cisco Identity Services Engine | =2.7.0 | |
| Cisco Identity Services Engine | =2.7.0-patch1 | |
| Cisco Identity Services Engine | =2.7.0-patch2 | |
| Cisco Identity Services Engine | =2.7.0-patch3 | |
| Cisco Identity Services Engine | =2.7.0-patch4 | |
| Cisco Identity Services Engine | =2.7.0-patch5 | |
| Cisco Identity Services Engine | =2.7.0-patch6 | |
| Cisco Identity Services Engine | =2.7.0-patch7 | |
| Cisco Identity Services Engine | =3.0.0 | |
| Cisco Identity Services Engine | =3.0.0-patch1 | |
| Cisco Identity Services Engine | =3.0.0-patch2 | |
| Cisco Identity Services Engine | =3.0.0-patch3 | |
| Cisco Identity Services Engine | =3.0.0-patch4 | |
| Cisco Identity Services Engine | =3.0.0-patch5 | |
| Cisco Identity Services Engine | =3.1 | |
| Cisco Identity Services Engine | =3.1-patch1 | |
| Cisco Identity Services Engine | =3.1-patch3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2022-20937.
What is the severity level of CVE-2022-20937?
The severity level of CVE-2022-20937 is medium.
What is the affected software for CVE-2022-20937?
The affected software for CVE-2022-20937 is Cisco Identity Services Engine (ISE) Software version 2.7.0 up to but excluding 2.7.0-patch7, version 3.0.0 up to but excluding 3.0.0-patch5, and version 3.1 up to but excluding 3.1-patch3.
What is the impact of CVE-2022-20937?
CVE-2022-20937 allows an unauthenticated, remote attacker to negatively affect the performance of an affected device.
Is there a fix available for CVE-2022-20937?
Yes, Cisco has released software updates to address CVE-2022-20937. Please refer to the vendor's advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/2.7.0
- version/cisco identity services engine/2.7.0-patch1
- version/cisco identity services engine/2.7.0-patch2
- version/cisco identity services engine/2.7.0-patch3
- version/cisco identity services engine/2.7.0-patch4
- version/cisco identity services engine/2.7.0-patch5
- version/cisco identity services engine/2.7.0-patch6
- version/cisco identity services engine/2.7.0-patch7
- version/cisco identity services engine/3.0.0
- version/cisco identity services engine/3.0.0-patch1
- version/cisco identity services engine/3.0.0-patch2
- version/cisco identity services engine/3.0.0-patch3
- version/cisco identity services engine/3.0.0-patch4
- version/cisco identity services engine/3.0.0-patch5
- version/cisco identity services engine/3.1
- version/cisco identity services engine/3.1-patch1
- version/cisco identity services engine/3.1-patch3