What is CVE-2022-20685?

CVE-2022-20685 is a high-severity vulnerability in Cisco Cyber Vision, classified under Integer Overflow or Wraparound. CVSS score: 7.5/10. Published 2024-11-15.

How severe is CVE-2022-20685?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2022-20685 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Integer overflow in Cisco Cyber Vision

CVE-2022-20685

A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Vulnerability class: Integer Overflow

Published 2024-11-15 · last modified 2026-08-11.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.015 (73.1th percentile), scored 2026-10-20.

Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.014 · newest: 0.015 · change: +0.000

Affected products

Cisco Cyber Vision — versions 3.0.0, 3.0.2, 3.0.3
Cisco Firepower Threat Defense Software — versions 6.2.3.14, 6.4.0.1, 6.2.3.7
Cisco Utd Snort Ips Engine Software — versions 3.17.1S, 16.12.3, Fuji-16.9.5
Cisco Cyber Vision — versions 3.0.0, 3.0.1, 3.0.2
Cisco Firepower Threat Defense — versions 6.2.3, 6.2.3.1, 6.2.3.2
Cisco Secure Firewall Threat Defense — versions 6.2.3, 6.2.3.1, 6.2.3.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine — versions 3.17.0s, 3.17.1s, 16.6.1

Weakness classification (CWE)

CWE-190 — Integer Overflow or Wraparound

Public proof-of-concept exploits

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-… (Vendor Advisory)
sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-… (Not Applicable)

Frequently asked questions

What is CVE-2022-20685?: CVE-2022-20685 is a high-severity vulnerability in Cisco Cyber Vision, classified under Integer Overflow or Wraparound. CVSS score: 7.5/10. Published 2024-11-15.
How severe is CVE-2022-20685?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2022-20685 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.