CVE-2022-20937

Summary

A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This vulnerability is due to insufficient management of system resources. An attacker could exploit this vulnerability by taking actions that cause Cisco ISE Software to receive specific RADIUS traffic. A successful and sustained exploit of this vulnerability could allow the attacker to cause reduced performance of the affected device, resulting in significant delays to RADIUS authentications. There are workarounds that address this vulnerability.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Identity Services Engine Software2.6.0affected
CiscoCisco Identity Services Engine Software2.6.0 p1affected
CiscoCisco Identity Services Engine Software2.6.0 p2affected
CiscoCisco Identity Services Engine Software2.6.0 p3affected
CiscoCisco Identity Services Engine Software2.6.0 p5affected
CiscoCisco Identity Services Engine Software2.6.0 p6affected
CiscoCisco Identity Services Engine Software2.6.0 p7affected
CiscoCisco Identity Services Engine Software2.6.0 p8affected
CiscoCisco Identity Services Engine Software2.6.0 p9affected
CiscoCisco Identity Services Engine Software2.6.0 p10affected
CiscoCisco Identity Services Engine Software2.6.0 p11affected
CiscoCisco Identity Services Engine Software2.6.0 p12affected
CiscoCisco Identity Services Engine Software2.7.0affected
CiscoCisco Identity Services Engine Software2.7.0 p1affected
CiscoCisco Identity Services Engine Software2.7.0 p2affected
CiscoCisco Identity Services Engine Software2.7.0 p3affected
CiscoCisco Identity Services Engine Software2.7.0 p4affected
CiscoCisco Identity Services Engine Software2.7.0 p5affected
CiscoCisco Identity Services Engine Software2.7.0 p6affected
CiscoCisco Identity Services Engine Software2.7.0 p7affected
CiscoCisco Identity Services Engine Software3.0.0affected
CiscoCisco Identity Services Engine Software3.0.0 p1affected
CiscoCisco Identity Services Engine Software3.0.0 p2affected
CiscoCisco Identity Services Engine Software3.0.0 p3affected
CiscoCisco Identity Services Engine Software3.0.0 p4affected
CiscoCisco Identity Services Engine Software3.0.0 p5affected
CiscoCisco Identity Services Engine Software3.1.0affected
CiscoCisco Identity Services Engine Software3.1.0 p1affected

Weaknesses

  • CWE-410: Insufficient Resource Pool

ADP Enrichment

CVE Program Container

Additional References

References