Denial of Service Vulnerability in Cisco Identity Services Engine

CVE-2023-20213

Summary

A vulnerability exists in the CDP processing feature of Cisco Identity Services Engine (ISE), allowing an unauthenticated, adjacent attacker to trigger a denial of service condition. This arises from inadequate bounds checking during the handling of CDP traffic. By sending specially crafted CDP packets, an attacker can crash the CDP process, hampering neighbor discovery and the device’s capability to assess the reachability of connected devices. Following an exploit, the CDP process requires manual intervention to restart, using the 'cdp enable' command in interface configuration mode.

References