CVE-2022-20945

A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain parameters within association request frames received by the AP. An attacker could exploit this vulnerability by sending a crafted 802.11 association request to a nearby device. An exploit could allow the attacker to unexpectedly reload the device, resulting in a DoS condition.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-assoc-dos-EgVqtON8	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:catalyst_9800-l_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:cisco:catalyst_9800-40_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:cisco:catalyst_9800-80_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:cisco:catalyst_9800-cl_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-09-30 19:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-20945

Mitre link : CVE-2022-20945

CVE.ORG link : CVE-2022-20945

JSON object : View

Products Affected

cisco

catalyst_9800-cl_firmware
catalyst_9800-80_firmware
catalyst_9800-cl
catalyst_9800-l_firmware
catalyst_9800-40
catalyst_9800-80
catalyst_9800-40_firmware
catalyst_9800-l

CWE

CWE-20

Improper Input Validation

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2022-20945", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "published": "2022-09-30T19:15:13.770", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-assoc-dos-EgVqtON8", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain parameters within association request frames received by the AP. An attacker could exploit this vulnerability by sending a crafted 802.11 association request to a nearby device. An exploit could allow the attacker to unexpectedly reload the device, resulting in a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en la comprobaci\u00f3n de tramas de asociaci\u00f3n 802.11 de los Puntos de Acceso (AP) de la Serie Catalyst 9100 de Cisco podr\u00eda permitir a un atacante adyacente no autenticado causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad es debido a la insuficiente comprobaci\u00f3n de entrada de determinados par\u00e1metros dentro de las tramas de petici\u00f3n de asociaci\u00f3n recibidas por el AP. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n de asociaci\u00f3n 802.11 dise\u00f1ada a un dispositivo cercano. Una explotaci\u00f3n podr\u00eda permitir al atacante recargar inesperadamente el dispositivo, resultando en una condici\u00f3n de DoS"}], "lastModified": "2023-11-07T03:43:22.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:catalyst_9800-l_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFD589EF-5964-4D1D-AF04-F89F9A55D29C", "versionEndExcluding": "17.6.4", "versionStartIncluding": "17.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E0BA345-B7D7-4975-9199-4DC7875BBFD0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:catalyst_9800-40_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47EEFB78-E5FC-4E88-9F4B-D487EAAD01A4", "versionEndExcluding": "17.6.4", "versionStartIncluding": "17.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B9ED0E5-CB20-4106-9CF2-8EB587B33543"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:catalyst_9800-80_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA042A95-3E41-4FF2-A1E4-9079F59C2D85", "versionEndExcluding": "17.6.4", "versionStartIncluding": "17.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2B0E620C-8E09-4F7C-A326-26013173B993"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:catalyst_9800-cl_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55DEEF60-5A9F-4C9D-98AC-83D089B7A315", "versionEndExcluding": "17.6.4", "versionStartIncluding": "17.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF93F1C8-669F-4ECB-8D81-ECDA7B550175"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}