Vulnslist

find the latest Cisco vulnerabilities

Cisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service Vulnerability

cisco-sa-cdp-dos-G8DPLWYG · Medium · Published · Updated

A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the service to restart, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of Cisco Discovery Protocol messages that are processed by the Cisco Discovery Protocol service. An attacker could exploit this vulnerability by sending a series of malicious Cisco Discovery Protocol messages to an affected device. A successful exploit could allow the attacker to cause the Cisco Discovery Protocol service to fail and restart. In rare conditions, repeated failures of the process could occur, which could cause the entire device to restart. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdp-dos-G8DPLWYG This advisory is part of the February 2022 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: February 2022 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.

Cisco advisory · CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

However, customers who do not use the Cisco Discovery Protocol feature can disable it either globally to fully close the attack vector or on individual interfaces to reduce the attack surface.
Disable Cisco Discovery Protocol in Cisco FXOS Software
Cisco Discovery Protocol is always enabled and cannot be disabled in Cisco FXOS Software. In Cisco FXOS Software releases 2.1 and later, Cisco Discovery Protocol is enabled on the management (mgmt0) port only.
Disable Cisco Discovery Protocol Globally on Cisco Nexus Switches that are Running Cisco NX-OS Software
To disable Cisco Discovery Protocol globally on Cisco Nexus Switches that are running Cisco NX-OS Software, use the no cdp enable command in global configuration mode, as shown in the following example:

nxos# conf t
Enter configuration commands, one per line. End with CNTL/Z. nxos(config)# no cdp enable nxos(config)# end nxos# copy running-config startup-config [########################################] 100% Copy complete.

Disable Cisco Discovery Protocol on an Interface on Cisco Nexus Switches that are Running Cisco NX-OS Software
To disable Cisco Discovery Protocol on an interface on Cisco Nexus Switches that are running Cisco NX-OS Software, use the no cdp enable command in interface configuration mode, as shown in the following example:

nxos# conf t
Enter configuration commands, one per line. End with CNTL/Z. nxos(config)# interface Ethernet1/1 nxos(config-if)# no cdp enable nxos(config-if)# end nxos# copy running-config startup-config [########################################] 100% Copy complete.

Disable Cisco Discovery Protocol on Cisco UCS Fabric Interconnects
Cisco Discovery Protocol cannot be disabled completely on Cisco UCS Fabric Interconnects.

Cisco Discovery Protocol can be disabled on server ports and appliance ports on Cisco CS Fabric Interconnects, but it cannot be disabled on Ethernet uplink ports, Ethernet port channel members, FCoE uplink ports, or management ports.

To disable Cisco Discovery Protocol on the server ports of a Cisco UCS Fabric Interconnect, use the disable cdp command in the default nw-ctrl-policy in the org scope, as shown in the following example:

ucs-fi# scope org
ucs-fi /org # enter nw-ctrl-policy default ucs-fi /org/nw-ctrl-policy # disable cdp ucs-fi /org/nw-ctrl-policy* # exit ucs-fi /org* # exit ucs-fi* # commit-buffer ucs-fi#

To disable Cisco Discovery Protocol on the appliance ports of a Cisco UCS Fabric Interconnect, use the disable cdp command in the default nw-ctrl-policy in the eth-storage scope, as shown in the following example:

ucs-fi* # scope eth-storage
ucs-fi /eth-storage* # enter nw-ctrl-policy default ucs-fi /eth-storage/nw-ctrl-policy* # disable cdp ucs-fi /eth-storage/nw-ctrl-policy* # exit ucs-fi /eth-storage* # exit ucs-fi* # commit-buffer ucs-fi#

While these mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

CVEsCVE-2022-20625
Cisco Bug IDsCSCvz72442, CSCvz72464, CSCvz72463, CSCvz72465, CSCvz72462, CSCvz72466, CSCvz74433, CSCvz72467
CVSS ScoreBase 4.3
Base 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:X
Product Names From Source
Cisco Unified Computing System (Managed), Cisco NX-OS Software 6.0(2)A8(1), Cisco NX-OS Software 6.0(2)A8(2), Cisco NX-OS Software 6.0(2)A8(3), Cisco NX-OS Software 6.0(2)A8(4), Cisco NX-OS Software 6.0(2)A8(4a), Cisco NX-OS Software 6.0(2)A8(5), Cisco NX-OS Software 6.0(2)A8(6), Cisco NX-OS Software 6.0(2)A8(7), Cisco NX-OS Software 6.0(2)A8(7a), Cisco NX-OS Software 6.0(2)A8(7b), Cisco NX-OS Software 6.0(2)A8(8), Cisco NX-OS Software 6.0(2)A8(9), Cisco NX-OS Software 6.0(2)A8(10a), Cisco NX-OS Software 6.0(2)A8(10), Cisco NX-OS Software 6.0(2)A8(11), Cisco NX-OS Software 6.0(2)A8(11a), Cisco NX-OS Software 6.0(2)A8(11b), Cisco NX-OS Software 7.0(3)F3(1), Cisco NX-OS Software 7.0(3)F3(2), Cisco NX-OS Software 7.0(3)F3(3), Cisco NX-OS Software 7.0(3)F3(3a), Cisco NX-OS Software 7.0(3)F3(4), Cisco NX-OS Software 7.0(3)F3(3c), Cisco NX-OS Software 7.0(3)F3(5), Cisco NX-OS Software 7.0(3)I4(1), Cisco NX-OS Software 7.0(3)I4(2), Cisco NX-OS Software 7.0(3)I4(3), Cisco NX-OS Software 7.0(3)I4(4), Cisco NX-OS Software 7.0(3)I4(5), Cisco NX-OS Software 7.0(3)I4(6), Cisco NX-OS Software 7.0(3)I4(7), Cisco NX-OS Software 7.0(3)I4(8), Cisco NX-OS Software 7.0(3)I4(8a), Cisco NX-OS Software 7.0(3)I4(8b), Cisco NX-OS Software 7.0(3)I4(8z), Cisco NX-OS Software 7.0(3)I4(1t), Cisco NX-OS Software 7.0(3)I4(6t), Cisco NX-OS Software 7.0(3)I4(9), Cisco NX-OS Software 7.0(3)I5(1), Cisco NX-OS Software 7.0(3)I5(2), Cisco NX-OS Software 7.0(3)I5(3), Cisco NX-OS Software 7.0(3)I5(3a), Cisco NX-OS Software 7.0(3)I5(3b), Cisco NX-OS Software 7.0(3)I6(1), Cisco NX-OS Software 7.0(3)I6(2), Cisco NX-OS Software 7.0(3)I7(1), Cisco NX-OS Software 7.0(3)I7(2), Cisco NX-OS Software 7.0(3)I7(3), Cisco NX-OS Software 7.0(3)I7(4), Cisco NX-OS Software 7.0(3)I7(5), Cisco NX-OS Software 7.0(3)I7(5a), Cisco NX-OS Software 7.0(3)I7(3z), Cisco NX-OS Software 7.0(3)I7(6), Cisco NX-OS Software 7.0(3)I7(6z), Cisco NX-OS Software 7.0(3)I7(7), Cisco NX-OS Software 7.0(3)I7(8), Cisco NX-OS Software 7.0(3)I7(9), Cisco NX-OS Software 7.0(3)I7(9w), Cisco NX-OS Software 7.0(3)I7(10), Cisco NX-OS Software 7.3(0)D1(1), Cisco NX-OS Software 7.3(0)DX(1), Cisco NX-OS Software 7.3(0)DY(1), Cisco NX-OS Software 7.3(0)N1(1), Cisco NX-OS Software 7.3(0)N1(1b), Cisco NX-OS Software 7.3(0)N1(1a), Cisco NX-OS Software 7.3(1)D1(1), Cisco NX-OS Software 7.3(1)DY(1), Cisco NX-OS Software 7.3(1)N1(1), Cisco NX-OS Software 7.3(2)D1(1), Cisco NX-OS Software 7.3(2)D1(2), Cisco NX-OS Software 7.3(2)D1(3), Cisco NX-OS Software 7.3(2)D1(3a), Cisco NX-OS Software 7.3(2)D1(1d), Cisco NX-OS Software 7.3(2)N1(1), Cisco NX-OS Software 7.3(2)N1(1b), Cisco NX-OS Software 7.3(2)N1(1c), Cisco NX-OS Software 7.3(3)N1(1), Cisco NX-OS Software 8.1(1), Cisco NX-OS Software 8.1(2), Cisco NX-OS Software 8.1(2a), Cisco NX-OS Software 8.1(1a), Cisco NX-OS Software 8.1(1b), Cisco NX-OS Software 8.2(1), Cisco NX-OS Software 8.2(2), Cisco NX-OS Software 8.2(3), Cisco NX-OS Software 8.2(4), Cisco NX-OS Software 8.2(5), Cisco NX-OS Software 8.2(6), Cisco NX-OS Software 8.2(7), Cisco NX-OS Software 8.2(7a), Cisco NX-OS Software 8.3(1), Cisco NX-OS Software 8.3(2), Cisco NX-OS Software 9.2(1), Cisco NX-OS Software 9.2(2), Cisco NX-OS Software 9.2(2t), Cisco NX-OS Software 9.2(3), Cisco NX-OS Software 9.2(3y), Cisco NX-OS Software 9.2(4), Cisco NX-OS Software 9.2(2v), Cisco NX-OS Software 7.3(4)N1(1), Cisco NX-OS Software 7.3(4)N1(1a), Cisco NX-OS Software 7.3(3)D1(1), Cisco NX-OS Software 7.0(3)IA7(1), Cisco NX-OS Software 7.0(3)IA7(2), Cisco NX-OS Software 7.0(3)IM7(2), Cisco NX-OS Software 7.3(4)D1(1), Cisco NX-OS Software 7.3(5)N1(1), Cisco NX-OS Software 8.4(1), Cisco NX-OS Software 8.4(1a), Cisco NX-OS Software 8.4(2), Cisco NX-OS Software 8.4(2a), Cisco NX-OS Software 8.4(3), Cisco NX-OS Software 8.4(2b), Cisco NX-OS Software 8.4(4), Cisco NX-OS Software 8.4(2c), Cisco NX-OS Software 8.4(4a), Cisco NX-OS Software 8.4(5), Cisco NX-OS Software 9.3(1), Cisco NX-OS Software 9.3(2), Cisco NX-OS Software 9.3(3), Cisco NX-OS Software 9.3(1z), Cisco NX-OS Software 9.3(4), Cisco NX-OS Software 9.3(5), Cisco NX-OS Software 9.3(6), Cisco NX-OS Software 9.3(5w), Cisco NX-OS Software 9.3(7), Cisco NX-OS Software 9.3(7k), Cisco NX-OS Software 9.3(7a), Cisco NX-OS Software 9.3(8), Cisco NX-OS Software 7.3(6)N1(1), Cisco NX-OS Software 7.3(6)N1(1a), Cisco NX-OS Software 7.3(5)D1(1), Cisco NX-OS Software 7.3(7)N1(1), Cisco NX-OS Software 7.3(7)N1(1a), Cisco NX-OS Software 7.3(7)N1(1b), Cisco NX-OS Software 7.3(6)D1(1), Cisco NX-OS Software 7.3(8)N1(1), Cisco NX-OS Software 7.3(8)N1(1a), Cisco NX-OS Software 7.3(8)N1(1b), Cisco NX-OS Software 7.3(7)D1(1), Cisco NX-OS Software 7.3(9)N1(1), Cisco NX-OS Software 10.1(1), Cisco NX-OS Software 10.1(2), Cisco NX-OS Software 8.5(1), Cisco NX-OS Software 7.3(10)N1(1), Cisco NX-OS Software 7.3(8)D1(1), Cisco NX-OS Software 10.2(1), Cisco NX-OS Software 10.2(1q), Cisco Firepower Extensible Operating System (FXOS) 2.2.1.63, Cisco Firepower Extensible Operating System (FXOS) 2.2.1.66, Cisco Firepower Extensible Operating System (FXOS) 2.2.1.70, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.17, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.19, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.24, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.26, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.28, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.54, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.60, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.71, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.83, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.86, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.91, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.97, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.101, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.137, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.148, Cisco Firepower Extensible Operating System (FXOS) 2.2.2.149, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.99, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.93, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.91, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.88, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.75, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.73, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.66, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.58, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.130, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.111, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.110, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.144, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.145, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.155, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.166, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.173, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.179, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.180, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.56, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.190, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.215, Cisco Firepower Extensible Operating System (FXOS) 2.3.1.216, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.131, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.157, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.166, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.169, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.174, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.187, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.192, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.204, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.214, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.224, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.229, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.230, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.238, Cisco Firepower Extensible Operating System (FXOS) 2.6.1.239, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.105, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.125, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.139, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.143, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.152, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.162, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.164, Cisco Firepower Extensible Operating System (FXOS) 2.8.1.172, Cisco Firepower Extensible Operating System (FXOS) 2.10.1.159, Cisco Firepower Extensible Operating System (FXOS) 2.10.1.166, Cisco NX-OS System Software in ACI Mode 13.2(1l), Cisco NX-OS System Software in ACI Mode 13.2(1m), Cisco NX-OS System Software in ACI Mode 13.2(2l), Cisco NX-OS System Software in ACI Mode 13.2(2o), Cisco NX-OS System Software in ACI Mode 13.2(3i), Cisco NX-OS System Software in ACI Mode 13.2(3n), Cisco NX-OS System Software in ACI Mode 13.2(3o), Cisco NX-OS System Software in ACI Mode 13.2(3r), Cisco NX-OS System Software in ACI Mode 13.2(4d), Cisco NX-OS System Software in ACI Mode 13.2(4e), Cisco NX-OS System Software in ACI Mode 13.2(3j), Cisco NX-OS System Software in ACI Mode 13.2(3s), Cisco NX-OS System Software in ACI Mode 13.2(5d), Cisco NX-OS System Software in ACI Mode 13.2(5e), Cisco NX-OS System Software in ACI Mode 13.2(5f), Cisco NX-OS System Software in ACI Mode 13.2(6i), Cisco NX-OS System Software in ACI Mode 13.2(41d), Cisco NX-OS System Software in ACI Mode 13.2(7f), Cisco NX-OS System Software in ACI Mode 13.2(7k), Cisco NX-OS System Software in ACI Mode 13.2(9b), Cisco NX-OS System Software in ACI Mode 13.2(8d), Cisco NX-OS System Software in ACI Mode 13.2(9f), Cisco NX-OS System Software in ACI Mode 13.2(9h), Cisco NX-OS System Software in ACI Mode 13.2(10e), Cisco NX-OS System Software in ACI Mode 13.2(10f), Cisco NX-OS System Software in ACI Mode 13.2(10g), Cisco NX-OS System Software in ACI Mode 14.0(1h), Cisco NX-OS System Software in ACI Mode 14.0(2c), Cisco NX-OS System Software in ACI Mode 14.0(3d), Cisco NX-OS System Software in ACI Mode 14.0(3c), Cisco NX-OS System Software in ACI Mode 14.1(1i), Cisco NX-OS System Software in ACI Mode 14.1(1j), Cisco NX-OS System Software in ACI Mode 14.1(1k), Cisco NX-OS System Software in ACI Mode 14.1(1l), Cisco NX-OS System Software in ACI Mode 14.1(2g), Cisco NX-OS System Software in ACI Mode 14.1(2m), Cisco NX-OS System Software in ACI Mode 14.1(2o), Cisco NX-OS System Software in ACI Mode 14.1(2s), Cisco NX-OS System Software in ACI Mode 14.1(2u), Cisco NX-OS System Software in ACI Mode 14.1(2w), Cisco NX-OS System Software in ACI Mode 14.1(2x), Cisco NX-OS System Software in ACI Mode 14.2(1i), Cisco NX-OS System Software in ACI Mode 14.2(1j), Cisco NX-OS System Software in ACI Mode 14.2(1l), Cisco NX-OS System Software in ACI Mode 14.2(2e), Cisco NX-OS System Software in ACI Mode 14.2(2f), Cisco NX-OS System Software in ACI Mode 14.2(2g), Cisco NX-OS System Software in ACI Mode 14.2(3j), Cisco NX-OS System Software in ACI Mode 14.2(3l), Cisco NX-OS System Software in ACI Mode 14.2(3n), Cisco NX-OS System Software in ACI Mode 14.2(3q), Cisco NX-OS System Software in ACI Mode 14.2(4i), Cisco NX-OS System Software in ACI Mode 14.2(4k), Cisco NX-OS System Software in ACI Mode 14.2(4o), Cisco NX-OS System Software in ACI Mode 14.2(4p), Cisco NX-OS System Software in ACI Mode 14.2(5k), Cisco NX-OS System Software in ACI Mode 14.2(5l), Cisco NX-OS System Software in ACI Mode 14.2(5n), Cisco NX-OS System Software in ACI Mode 14.2(6d), Cisco NX-OS System Software in ACI Mode 14.2(6g), Cisco NX-OS System Software in ACI Mode 14.2(6h), Cisco NX-OS System Software in ACI Mode 14.2(6l), Cisco NX-OS System Software in ACI Mode 14.2(7f), Cisco NX-OS System Software in ACI Mode 14.2(7l), Cisco NX-OS System Software in ACI Mode 14.2(6o), Cisco NX-OS System Software in ACI Mode 15.0(2e), Cisco NX-OS System Software in ACI Mode 15.0(2h), Cisco NX-OS System Software in ACI Mode 15.1(2e), Cisco NX-OS System Software in ACI Mode 15.1(3e), Cisco NX-OS System Software in ACI Mode 15.1(4c), Cisco NX-OS System Software in ACI Mode 15.2(1g), Cisco NX-OS System Software in ACI Mode 15.2(2e), Cisco NX-OS System Software in ACI Mode 15.2(2f), Cisco NX-OS System Software in ACI Mode 15.2(2g), Cisco NX-OS System Software in ACI Mode 15.2(2h), Cisco Firepower Extensible Operating System (FXOS), Cisco NX-OS Software, Cisco NX-OS System Software in ACI Mode, Cisco MDS 9000 Multilayer Directors and Fabric Switches, Cisco Nexus 7000 Series Switches, Cisco Nexus 5000 Series Switches, Cisco Nexus 3000 Series Switches, Cisco Nexus 6000 Series Switches, Cisco Nexus 9000 Series Switches, Cisco Firepower 9000 Series, Cisco Firepower 4100 Series

Related Products

Product CVE Evidence
Firepower Extensible Operating System CVE-2022-20625 Cisco OpenVuln
Cisco Unified Computing System (Managed) CVE-2022-20625 Cisco OpenVuln
Cisco Nexus 9000 Series Switches CVE-2022-20625 Cisco OpenVuln
Cisco Nexus 7000 Series Switches CVE-2022-20625 Cisco OpenVuln
Cisco Nexus 6000 Series Switches CVE-2022-20625 Cisco OpenVuln
Cisco Nexus 5000 Series Switches CVE-2022-20625 Cisco OpenVuln
Cisco Nexus 3000 Series Switches CVE-2022-20625 Cisco OpenVuln
Cisco Nexus 3000 Series Switch CVE-2022-20625 Cisco OpenVuln
Cisco NX-OS System Software in ACI Mode CVE-2022-20625 Cisco OpenVuln
Cisco NX-OS Software CVE-2022-20625 Cisco OpenVuln
Cisco MDS 9000 Multilayer Directors and Fabric Switches CVE-2022-20625 Cisco OpenVuln
Cisco Firepower Extensible Operating System (FXOS) CVE-2022-20625 Cisco OpenVuln
Cisco Firepower Extensible Operating System CVE-2022-20625 Cisco OpenVuln
Cisco Firepower 9000 Series CVE-2022-20625 Cisco OpenVuln
Cisco Firepower 4100 Series CVE-2022-20625 Cisco OpenVuln