CVE-2022-20767
Last modified
CVE-2022-20767 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement rule. EPSS estimates a 1.61% chance of exploitation in the next 30 days.
Description
A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement rule. An attacker could exploit this vulnerability by sending crafted UDP packets through an affected device to force a buildup of UDP connections. A successful exploit could allow the attacker to cause traffic that is going through the affected device to be dropped, resulting in a DoS condition. Note: This vulnerability only affects Cisco FTD devices that are running Snort 3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Secure Firewall Threat Defense | < 7.0.2 |
| Cisco | Secure Firewall Threat Defense | 7.1.0 |
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FTD-snort3-DOS-Aq38LVdMMitigation, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FTD-snort3-DOS-Aq38LVdMMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-20767?
How severe is CVE-2022-20767?
How do I fix CVE-2022-20767?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-20761A vulnerability in the integrated wireless access point (AP)…6.5
- CVE-2022-20762A vulnerability in the Common Execution Environment (CEE) Co…7.8
- CVE-2022-20763A vulnerability in the login authorization components of Cis…8.8
- CVE-2022-20764Multiple vulnerabilities in the web engine of Cisco TelePres…8.1
- CVE-2022-20765A vulnerability in the web applications of Cisco UCS Directo…4.8
- CVE-2022-20766A vulnerability in the Cisco Discovery Protocol functio…5.3
- CVE-2022-20768A vulnerability in the logging component of Cisco TelePresen…4.9
- CVE-2022-20769A vulnerability in the authentication functionality of Cisco…6.5
- CVE-2022-2077Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-20770On April 20, 2022, the following vulnerability in the ClamAV…7.5
- CVE-2022-20771On April 20, 2022, the following vulnerability in the ClamAV…7.5
- CVE-2022-20772A vulnerability in Cisco Email Security Appliance (ESA) and …5.3
Are you affected by CVE-2022-20767?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST