{"id":"CVE-2022-20846","aliases":["EUVD-2022-26096","GHSA-xqfj-6ppw-2qw5"],"status":"published","title":"Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow Vulnerability","description":"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol implementation for Cisco\u0026nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco\u0026nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco\u0026nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco\u0026nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco\u0026nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco\u0026nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). \u0026nbsp;Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see .","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00999,"percentile":0.63007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2024-11-15T15:32:38Z","modified":"2026-06-17T04:25:14Z","products":[{"vendor":"cisco","product":"cisco ios xr software"},{"vendor":"cisco","product":"ios_xr"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2","tags":["Vendor Advisory"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt","tags":["Not Applicable"]},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6","tags":["Not Applicable"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20846"},{"url":"https://github.com/advisories/GHSA-xqfj-6ppw-2qw5"}],"sources":{"cve":[{"id":"CVE-2022-20846","title":"Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow Vulnerability","description":"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol implementation for Cisco\u0026nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco\u0026nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco\u0026nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco\u0026nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco\u0026nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco\u0026nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). \u0026nbsp;Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see .","status":"published","published":"2024-11-15T15:32:38.495Z","modified":"2024-11-15T16:41:07.934Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:34:24.627322Z"}],"euvd":[{"id":"EUVD-2022-26096","description":"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol implementation for Cisco\u0026nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco\u0026nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco\u0026nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco\u0026nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco\u0026nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco\u0026nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). \u0026nbsp;Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see .","status":"published","published":"2024-11-15T15:32:38Z","modified":"2024-11-15T16:41:07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:59.542658Z"}],"ghsa":[{"id":"GHSA-xqfj-6ppw-2qw5","title":"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol implementation for Cisco\u0026nbsp;IOS XR...","description":"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol implementation for Cisco\u0026nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco\u0026nbsp;Discovery Protocol process to reload on an affected device.\nThis vulnerability is due to a heap buffer overflow in certain Cisco\u0026nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco\u0026nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco\u0026nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco\u0026nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). \u0026nbsp;Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see .","status":"published","published":"2024-11-15T18:30:49Z","modified":"2025-08-05T15:30:32Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:03:10.73907Z"}],"nvd":[{"id":"CVE-2022-20846","description":"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol implementation for Cisco\u0026nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco\u0026nbsp;Discovery Protocol process to reload on an affected device.\r\nThis vulnerability is due to a heap buffer overflow in certain Cisco\u0026nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco\u0026nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco\u0026nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco\u0026nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). \u0026nbsp;Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see .","status":"published","published":"2024-11-15T16:15:23.12Z","modified":"2026-06-17T04:25:14.643Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:07:40.977475Z"}]}}