QID 317222

Date Published: 2022-09-29

QID 317222: Cisco Internetwork Operating System (IOS) XR Software Broadband Network Gateway PPP over Ethernet Denial of Service (DoS) Vulnerability (cisco-sa-iosxr-bng-Gmg5Gxt)

A vulnerability in the Broadband Network Gateway PPP over Ethernet (PPPoE) feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the PPPoE process to continually crash.

Affected Products
ASR 9000 Series Aggregation Services Routers

QID Detection Logic (Authenticated):
The check matches Cisco IOS XR version retrieved via Unix Auth using "show version" command Along with it checks if Cisco Discovery Protocol is enabled.

A successful exploit could allow the attacker to cause the PPPoE process to continually restart, resulting in a denial of service condition (DoS).

CVSS V3 rated as High - 6.1 severity.

CVSS V2 rated as Medium - 4.6 severity.

Solution

Customers are advised to refer to cisco-sa-iosxr-bng-Gmg5Gxt for more information.

Vendor References

cisco-sa-iosxr-bng-Gmg5Gxt - tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt

CVEs related to QID 317222

CVE-2022-20849 |

Software Advisories

Advisory ID	Software	Component	Link
cisco-sa-iosxr-bng-Gmg5Gxt			tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].