CVE-2022-20920: Cisco IOS

High severity, CVSS 7.7. EPSS: 0.9% chance of exploitation in the next 30 days.

A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to improper handling of resources during an exceptional situation. An attacker could exploit this vulnerability by continuously connecting to an affected device and sending specific SSH requests. A successful exploit could allow the attacker to cause the affected device to reload.

Affected products

• Cisco IOS: version 12.2(6)i1 only; version 12.2(58)ex only; version 12.2(58)ey only; version 12.2(58)ey1 only; version 12.2(58)ey2 only; version 12.2(58)ez only; …
• Cisco IOS XE: version 3.2.0se only; version 3.2.1se only; version 3.2.2se only; version 3.2.3se only; version 3.2se only; version 3.3.0se only; …

Published 2022-10-10. Last modified 2026-06-17.