CVE-2022-20933 The vulnerability in Cisco AnyConnect VPN server could cause a DoS on an affected device.
An attacker could also exploit this vulnerability by sending a crafted request to the device through an HTTP connection, such as a malicious web-based request or an email message. A successful exploit could allow the attacker to send malicious requests to the Cisco AnyConnect VPN server and cause the server to crash and restart, resulting in the failure of the established HTTP connections and forcing remote users to initiate a new HTTP connection and re-authenticate. A sustained attack could prevent new HTTP connections from being established. Cisco has confirmed the existence of this vulnerability in a production environment and has released an advisory describing the vulnerability and providing mitigation instructions. The following versions of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices are vulnerable: Cisco Meraki MX 4800 and 4810 series
Cisco Meraki Z3 Teleworker Gateway devices Cisco has confirmed the existence of this vulnerability in a production environment and has released an advisory describing the vulnerability and providing mitigation instructions. The following versions of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices are vulnerable: How to determine if your device is vulnerable To determine if your Cisco Meraki MX or Cisco Meraki Z3 Teleworker Gateway device is vulnerable, see the table below
Cisco Meraki MX Series
Device Cisco Meraki MX Series
MX 4810-1
MX 4810-2
MX 4810-3
MX 4810-4
MX 581
MX 721
Mx 811
Mx 821
Mx 831
Z3 Teleworker Gateway device Cisco Meraki Z3 Series
MX4800 and MX4810 Series
Device Vulnerabilities
The following devices are vulnerable: Cisco Meraki MX4800 and MX4810 series
Cisco Meraki Z3 Teleworker Gateway devices Cisco has released an advisory describing the vulnerability and providing mitigation instructions and a table with a list of affected products. The following versions of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices are vulnerable: Cisco Meraki MX4800, MX4805, MX4807, MX4905, MX4907
Cisco Meraki Z3 Teleworker Gateway models: MG120, MG130, MG140
Timeline
Published on: 10/26/2022 15:15:00 UTC
Last modified on: 10/31/2022 17:40:00 UTC