Integer overflow in Cisco Cyber Vision
CVE-2022-20685
A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Vulnerability class: Integer Overflow
EPSS: 0.014 (71.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Cisco Cyber Vision — versions 3.0.0, 3.0.2, 3.0.3
- Cisco Firepower Threat Defense Software — versions 6.2.3.14, 6.4.0.1, 6.2.3.7
- Cisco Utd Snort Ips Engine Software — versions 3.17.1S, 16.12.3, Fuji-16.9.5
- Cisco Cyber_vision — versions 3.0.0, 3.0.1, 3.0.2
- Cisco Firepower_threat_defense — versions 6.2.3, 6.2.3.1, 6.2.3.2
- Cisco Secure_firewall_threat_defense — versions 6.2.3, 6.2.3.1, 6.2.3.2
- Cisco Unified_threat_defense_snort_intrusion_prevention_system_engine — versions 3.17.0s, 3.17.1s, 16.6.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (Vendor Advisory)
- psirt@cisco.com (Not Applicable)
Frequently asked questions
- What is CVE-2022-20685?
- CVE-2022-20685 is a high-severity vulnerability in Cisco Cyber Vision, classified under Integer Overflow or Wraparound. CVSS score: 7.5/10. Published 2024-11-15.
- How severe is CVE-2022-20685?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-20685 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.