Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities

published 2022-04-15 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-25911

cvss: 4.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Patch / fix

fixed in 1

cisco ios 15.2\(7\)e5

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-11-06)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	4.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	4.9	AV:L/AC:L/Au:N/C:N/I:N/A:C

Affected products

Cisco Cisco IOS ROMMON Software

Classification

Weakness

CWE-1221 Incorrect Register Defaults or Module Parameters
CWE-665 Improper Initialization

Technology feeds

Cisco IOS rss critical rss

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-cdb-cmicr-vulns-KJjFtNb
vendor-advisory

Sources

CVE List CVE-2022-20661
NVD CVE-2022-20661

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary