CVE-2022-20837

Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability

HIGH

8.6

CVSS Score

Published: October 10, 2022 at 08:43 PM UTC

Updated: June 17, 2026 at 04:25 AM UTC

5 products affected across 1 vendorIOS XeCatalyst 8500Catalyst 8500-4Qc

Using Cisco IOS XE Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XE Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.6

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. This vulnerability cannot be exploited by sending IPv6 traffic.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xe · Cisco

95%

All versions

cisco-asr-1000-esp100-x (environment) · cisco-asr-1000-esp200-x (environment) · cisco-catalyst-8500 (environment) · cisco-catalyst-8500-4qc (environment)

Asr 1000-Esp100-X · Ciscodevice

80%

All versions

Asr 1000-Esp200-X · Ciscodevice

80%

All versions

Catalyst 8500 · Ciscodevice

80%

All versions

Catalyst 8500-4Qc · Ciscodevice

80%

All versions