CVE-2022-20837

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. This vulnerability cannot be exploited by sending IPv6 traffic.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-208384.8Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-208394.8Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-20845.5Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could CVE-2022-208404.8Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-208419.0Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attack CVE-2022-208429.8Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attack CVE-2022-208434.8Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-208445.3A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could all CVE-2022-208456.0A vulnerability in the TL1 function of Cisco Network Convergence System (NCS) 4000 Series could allow an authenticated, local attacker CVE-2022-208464.3A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent CVE-2022-208477.5A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow a CVE-2022-208487.5A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Acces