Vulnerability · Published Aug 25, 2022 · Assigned by cisco

CVE-2022-20823Cisco NX-OS Software OSPFv3 Denial of Service Vulnerability

High 8.6

In plain English

A high-severity security flaw in Cisco NX-OS Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.1%top 33.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incomplete input validation of specific OSPFv3 packets. An attacker could exploit this vulnerability by sending a malicious OSPFv3 link-state advertisement (LSA) to an affected device. A successful exploit could allow the attacker to cause the OSPFv3 process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: The OSPFv3 feature is disabled by default. To exploit this vulnerability, an attacker must be able to establish a full OSPFv3 neighbor state with an affected device. For more information about exploitation conditions, see the Details section of this advisory.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco NX-OS Software	n/a

Weakness: CWE-126 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References

20220824 Cisco NX-OS Software OSPFv3 Denial of Service Vulnerability vendor-advisory, x_refsource_CISCO