CVE-2022-20922
What it is
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper management of system resources when the Snort detection engine is processing SMB2 traffic. An attacker could exploit these vulnerabilities by sending a high rate of certain types of SMB2 packets through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process, resulting in a DoS condition. Note: When the snort preserve-connection option is enabled for the Snort detection engine, a successful exploit could also allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network. The snort preserve-connection setting is enabled by default. See the Details ["#details"] section of this advisory for more information. Note: Only products that have Snort 3 configured are affected. Products that are configured with Snort 2 are not affected.
At a glance
- Exploitability
- Can be exploited over the network without logging in. Limited direct impact.
- Exploit odds
- 0.9% chance of exploitation in the next 30 days (EPSS).
- Fix
- No patch or advisory is linked yet. Look at mitigations or restrict exposure.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 0.9% in the next 30 days (EPSS).
- Severity: 5.8 MEDIUM (CVSS).
- Fix: none linked yet, which raises it.
Details
- Published
- Last modified
- Exploit probability
- 0.9% · EPSS, next 30 days
- Weakness
- CWE-244
- Record status
- Modified
Affected
- Cisco Secure Firewall Threat Defense 7.1.0
- Cisco Secure Firewall Threat Defense 7.1.0.1
- Cisco Secure Firewall Threat Defense 7.1.0.2
- Cisco Secure Firewall Threat Defense 7.2.0
- Cisco Secure Firewall Threat Defense 7.2.0.1
- Cisco Umbrella Virtual Appliance 1.5.4
- Cisco Umbrella Virtual Appliance 1.5.5
- Cisco Umbrella Virtual Appliance 1.5.6
Attack profile CVSS 3.1 · 5.8
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2022-20922.md and follow it. Check whether this project is affected by CVE-2022-20922. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
