{"id":"CVE-2023-20072","published":"2023-03-23T00:00:00Z","modified":"2024-10-28T16:32:38Z","title":"Cisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service Vulnerability","vendor":"Cisco","product":"Cisco IOS XE Software","tier":"tail","description":{"text":"A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of large fragmented tunnel protocol packets. One example of a tunnel protocol is Generic Routing Encapsulation (GRE). An attacker could exploit this vulnerability by sending crafted fragmented packets to an affected system. A successful exploit could allow the attacker to cause the affected system to reload, resulting in a DoS condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0098,"percentile":0.62097,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-gre-crash-p6nE5Sq5","tags":["vendor-advisory"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":12.42},{"name":"CVSS severity","points":6.02}]},"vendorSlug":"cisco","euvd":{"id":"EUVD-2023-24251","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-cisco-ios-xe-cwe-20"}}