{"id":"CVE-2022-20717","state":"PUBLISHED","title":"Cisco SD-WAN vEdge Routers Denial of Service Vulnerability","description":"A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of memory, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient memory management when an affected device receives large amounts of traffic. An attacker could exploit this vulnerability by sending malicious traffic to an affected device. A successful exploit could allow the attacker to cause the device to crash, resulting in a DoS condition.","publishedAt":"2022-04-15T14:15:28.491Z","updatedAt":"2024-11-06T16:27:31.894Z","severity":{"score":5.5,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco SD-WAN vEdge router"],"affected":[{"vendor":"Cisco","product":"Cisco SD-WAN vEdge router","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vedge-dos-jerVm4bB"],"weaknesses":["CWE-789"],"ingestedAt":"2026-10-29T19:49:32.184Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/20xxx/CVE-2022-20717.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-20717","state":"PUBLISHED","datePublished":"2022-04-15T14:15:28.491Z","dateUpdated":"2024-11-06T16:27:31.894Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2021-11-02T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco SD-WAN vEdge Routers Denial of Service Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of memory, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient memory management when an affected device receives large amounts of traffic. An attacker could exploit this vulnerability by sending malicious traffic to an affected device. A successful exploit could allow the attacker to cause the device to crash, resulting in a DoS condition."}],"affected":[{"vendor":"Cisco","product":"Cisco SD-WAN vEdge router","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vedge-dos-jerVm4bB","name":"20220413 Cisco SD-WAN vEdge Routers Denial of Service Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-789","description":"CWE-789","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2022-04-15T14:15:28.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2022-04-13T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-sdwan-vedge-dos-jerVm4bB","defect":[["CSCvt55609"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2022-04-13T16:00:00","ID":"CVE-2022-20717","STATE":"PUBLIC","TITLE":"Cisco SD-WAN vEdge Routers Denial of Service Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco SD-WAN vEdge router","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of memory, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient memory management when an affected device receives large amounts of traffic. An attacker could exploit this vulnerability by sending malicious traffic to an affected device. A successful exploit could allow the attacker to cause the device to crash, resulting in a DoS condition."}]},"exploit":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"impact":{"cvss":{"baseScore":"5.5","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-789"}]}]},"references":{"reference_data":[{"name":"20220413 Cisco SD-WAN vEdge Routers Denial of Service Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vedge-dos-jerVm4bB"}]},"source":{"advisory":"cisco-sa-sdwan-vedge-dos-jerVm4bB","defect":[["CSCvt55609"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vedge-dos-jerVm4bB","name":"20220413 Cisco SD-WAN vEdge Routers Denial of Service Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T02:24:49.363Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-06T15:59:05.080616Z","id":"CVE-2022-20717","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-06T16:27:31.894Z"}}]}}}