CVE-2022-20714: cisco cisco ios xr software Buffer Over-read

Vulnerability summary

CVE-2022-20714 is a high (CVSS 8.6) Buffer Over-read vulnerability in cisco cisco ios xr software. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.5% of scored vulnerabilities.

Timeline

1. 15-04-2022
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the data plane microcode of Lightspeed-Plus line cards for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the line card to reset. This vulnerability is due to the incorrect handling of malformed packets that are received on the Lightspeed-Plus line cards. An attacker could exploit this vulnerability by sending a crafted IPv4 or IPv6 packet through an affected device. A successful exploit could allow the attacker to cause the Lightspeed-Plus line card to reset, resulting in a denial of service (DoS) condition for any traffic that traverses that line card.

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.