CVE-2022-20846

A vulnerability in the Cisco&amp;nbsp;Discovery Protocol implementation for Cisco&amp;nbsp;IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco&amp;nbsp;Discovery Protocol process to reload on an affected device.<br /> This vulnerability is due to a heap buffer overflow in certain Cisco&amp;nbsp;Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco&amp;nbsp;Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow, which could cause the Cisco&amp;nbsp;Discovery Protocol process to reload on the device. The bytes that can be written in the buffer overflow are restricted, which limits remote code execution.Note: Cisco&amp;nbsp;Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). &amp;nbsp;Cisco&amp;nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the September 2022 release of the Cisco&amp;nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see .