CVE-2022-20697: Cisco IOS

High severity, CVSS 8.6. EPSS: 1.2% chance of exploitation in the next 30 days.

A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP server code. An attacker could exploit this vulnerability by sending a large number of HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Affected products

• Cisco IOS: version 15.1(3)svr1 only; version 15.1(3)svr2 only; version 15.1(3)svr3 only; version 15.1(3)svs only; version 15.1(3)svs1 only; version 15.1(3)svt1 only; …
• Cisco IOS XE: version 3.11.3ae only; version 3.11.3e only; version 3.11.4e only

Published 2022-04-15. Last modified 2026-06-17.