CVE-2022-20728

mediumPriorität · verfolgen · 19EPSS 0.003 · 19. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.27% (19th) EPSS

CVSS 4.7 · medium

Is it mine?

43 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · bewertet 2026-10-27

A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from the native VLAN to clients within nonnative VLANs on an affected device. This vulnerability is due to a logic error on the AP that forwards packets that are destined to a wireless client if they are received on the native VLAN. An attacker could exploit this vulnerability by obtaining access to the native VLAN and directing traffic directly to the client through their MAC/IP combination. A successful exploit could allow the attacker to bypass VLAN separation and potentially also bypass any Layer 3 protection mechanisms that are deployed.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco Aironet Access Point Software (IOS XE Controller)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

4.7

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.14.7mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 1.4

v3.14.7mediumAV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.14.7mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · ENISA EU

v3.14.7mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · psirt@cisco.com USAusnutzbarkeit 2.8 · Auswirkung 1.4

v3.14.3mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.7mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-284USCWE-284US

betroffene Produkte (43)

Betroffene Produkte und Versionsbereiche.

Cisco Cisco Aironet Access Point Software (IOS XE Controller)alle Versionencisco_csafUS
Cisco Cisco Aironet Access Point Software (IOS XE Controller)≤ n/aenisa_euvdEU
Cisco Systems Inc. Catalyst 9800≤ 17.3.6 + APSP patchfstec_bduRU
Cisco Systems Inc. Catalyst 980017.4 → 17.6.2fstec_bduRU
Cisco Systems Inc. Catalyst IW 6300alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Aironet 1540alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Aironet 1560alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Aironet 1800alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Aironet 2800alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Aironet 3800alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Aironet 4800alle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Business 100 Series Access Pointsalle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Business 200 Series Access Pointsalle Versionenfstec_bduRU
Cisco Systems Inc. Cisco Catalyst 9100alle Versionenfstec_bduRU
Cisco Systems Inc. ESW 6300alle Versionenfstec_bduRU
Cisco Systems Inc. Integrated AP on 1100 Integrated Services Routersalle Versionenfstec_bduRU
Cisco Systems Inc. Wireless LAN controller≤ 8.10.181.0fstec_bduRU
cisco aironet 1542d firmware= 017.006(001)nvdUScpe:2.3:o:cisco:aironet_1542d_firmware:*:*:*:*:*:*:*:*
cisco aironet 1542i firmware= 017.006(001)nvdUScpe:2.3:o:cisco:aironet_1542i_firmware:*:*:*:*:*:*:*:*
cisco aironet 1562d firmware= 017.006(001)nvdUScpe:2.3:o:cisco:aironet_1562d_firmware:*:*:*:*:*:*:*:*

20 von 43 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

cisco-sa-apvlan-TDTtb4FYCisco Access Points VLAN Bypass from Native VLAN Vulnerability2022-09-27csaf · cisco_csafUS
A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from the native VLAN to clients within nonnative VLANs on an affected device. This vulnerability is due to a logic error on the AP that forwards packets that are destined to a wireless client if they are received on the native VLAN. An attacker could exploit this vulnerability by obtaining access to the native VLAN and directing traffic directly to the client through their MAC/IP combination. A successful exploit could allow the attacker to bypass VLAN separation and potentially also bypass any Layer 3 protection mechanisms that are deployed. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisco_csaf nvd NVD CVE.org MITRE

veröffentlicht 2022-09-30geändert 2026-06-17

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan