CVE-2022-20625: Cisco FXOS Discovery Protocol DoS Vulnerability

CVE-2022-20625 Overview

CVE-2022-20625 is a denial of service (DoS) vulnerability in the Cisco Discovery Protocol (CDP) service of Cisco Firepower Extensible Operating System (FXOS) Software and Cisco NX-OS Software. The flaw stems from improper handling of CDP messages processed by the service. An unauthenticated, adjacent attacker can send crafted CDP messages to an affected device and cause the CDP service to fail and restart. Cisco notes that, in rare conditions, repeated process failures could cause the entire device to restart. The issue is tracked under [CWE-399] (Resource Management Errors) and affects a broad range of Cisco data center, campus, storage, and unified computing switches.

Critical Impact
An unauthenticated attacker on an adjacent Layer 2 segment can disrupt the CDP service on Cisco FXOS and NX-OS devices, with the potential to trigger a full device reload under repeated failure conditions.

Affected Products

Cisco Firepower Extensible Operating System (FXOS) on Firepower 4100 Series and 9300 Security Appliances
Cisco NX-OS Software on Nexus 1000V, 3000, 7000, 7700, 9000, and MDS 9000 Series Switches
Cisco UCS 6200, 6300, 6324, 6400, and 64108 Series Fabric Interconnects

Discovery Timeline

2022-02-23 - CVE-2022-20625 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-20625

Vulnerability Analysis

The vulnerability resides in the CDP service of Cisco FXOS and NX-OS. CDP is a Layer 2 protocol used for neighbor discovery between Cisco devices. The service receives and parses CDP advertisements on physical interfaces where the protocol is enabled.

Improper handling of malformed or unexpected CDP messages causes the CDP process to terminate. The platform restarts the process automatically, but the restart cycle interrupts neighbor discovery and management visibility. Cisco's advisory states that repeated process failures can escalate to a full device reload.

Because CDP is enabled by default on most Cisco platforms and operates without authentication, any device sharing the same Layer 2 broadcast domain can submit CDP frames. Successful exploitation does not require credentials, user interaction, or routed network access.

Root Cause

The root cause is improper input validation when parsing CDP message fields. The CDP daemon fails to safely handle a series of malicious messages, leading to an unhandled error condition that terminates the process. This pattern is consistent with [CWE-399] resource management errors.

Attack Vector

The attack requires adjacent network access (AV:A). An attacker connects a host or compromised device to a switch port, trunk, or Layer 2 segment reachable by the target. The attacker then transmits a series of malformed CDP frames to the well-known CDP multicast MAC address 01:00:0c:cc:cc:cc. Each malformed message causes the CDP service to crash and restart, producing a sustained denial of service against the CDP subsystem and, potentially, the entire device.

CDP frames are transmitted as raw Layer 2 packets using EtherType 0x2000 and the SNAP header for CDP. Exploitation typically involves a custom packet crafting tool that produces CDP type-length-value (TLV) structures with malformed length fields or unexpected TLV combinations. No public proof-of-concept code is referenced in the NVD data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2022-20625

Indicators of Compromise

Repeated CDP process restarts logged on Cisco FXOS or NX-OS devices, visible through show processes log and syslog messages referencing the cdpd process.
Sudden gaps in CDP neighbor tables (show cdp neighbors) followed by re-population shortly after.
Unexpected device reloads on affected platforms with crash files implicating the CDP component.

Detection Strategies

Monitor syslog and SNMP traps for CDP-3- and process crash events emitted by NX-OS and FXOS, correlating restart frequency with traffic on access ports.
Capture Layer 2 traffic at the access edge and inspect CDP frames for malformed TLV structures, oversized lengths, or unusually high CDP message rates from a single MAC address.
Track baseline CDP neighbor stability per port and alert on repeated neighbor flaps that align with process restarts.

Monitoring Recommendations

Forward NX-OS and FXOS syslog to a centralized logging or SIEM platform and create alerts for cdpd core dumps and CDP process restarts.
Enable port security and 802.1X on access ports to limit which devices can inject CDP traffic.
Review crash and event logs after maintenance windows or unexpected outages to identify CDP-related faults that match this CVE's signature.

How to Mitigate CVE-2022-20625

Immediate Actions Required

Inventory all Cisco FXOS, NX-OS, MDS, Nexus, and UCS Fabric Interconnect devices and identify versions vulnerable per Cisco's advisory.
Apply Cisco-supplied fixed software releases for FXOS and NX-OS as listed in the Cisco Security Advisory cisco-sa-cdp-dos-G8DPLWYG.
Restrict physical and logical access to Layer 2 segments where untrusted devices may connect, especially on management and out-of-band networks.

Patch Information

Cisco has released fixed software for affected FXOS and NX-OS trains. Refer to the Cisco Security Advisory cisco-sa-cdp-dos-G8DPLWYG for the complete list of fixed releases mapped to each platform family. There are no documented software workarounds beyond disabling CDP, as noted below.

Workarounds

Disable CDP globally with no cdp enable (NX-OS) where neighbor discovery is not required for operations or telephony.
Disable CDP on a per-interface basis on access ports facing untrusted hosts using no cdp enable under the interface configuration.
Restrict Layer 2 access through port security, private VLANs, and 802.1X to ensure only authorized devices can transmit CDP frames.

bash

# Disable CDP globally on Cisco NX-OS
switch# configure terminal
switch(config)# no cdp enable

# Disable CDP on a specific untrusted access interface
switch(config)# interface Ethernet1/10
switch(config-if)# no cdp enable
switch(config-if)# end
switch# copy running-config startup-config