Lucene search

[email protected]CVE-2022-20681

HistoryApr 15, 2022 - 3:15 p.m.

CVE-2022-20681

2022-04-1515:15:12

CWE-266

[email protected]

web.nvd.nist.gov

104

cve-2022-20681

vulnerability

cisco

ios xe

catalyst 9000

switches

wireless controllers

privilege escalation

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability in the CLI of Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an authenticated, local attacker to elevate privileges to level 15 on an affected device. This vulnerability is due to insufficient validation of user privileges after the user executes certain CLI commands. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged user and then executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands with level 15 privileges on the affected device.

Affected configurations

NVD

Node

ciscoios_xeMatch16.11.1

ciscoios_xeMatch16.11.1a

ciscoios_xeMatch16.11.1b

ciscoios_xeMatch16.11.1c

ciscoios_xeMatch16.11.1s

ciscoios_xeMatch16.11.2

ciscoios_xeMatch16.12.1

ciscoios_xeMatch16.12.1a

ciscoios_xeMatch16.12.1c

ciscoios_xeMatch16.12.1s

ciscoios_xeMatch16.12.1t

ciscoios_xeMatch16.12.1w

ciscoios_xeMatch16.12.1x

ciscoios_xeMatch16.12.1y

ciscoios_xeMatch16.12.1z

ciscoios_xeMatch16.12.1z1

ciscoios_xeMatch16.12.1z2

ciscoios_xeMatch16.12.2

ciscoios_xeMatch16.12.2a

ciscoios_xeMatch16.12.2s

ciscoios_xeMatch16.12.2t

ciscoios_xeMatch16.12.3

ciscoios_xeMatch16.12.3a

ciscoios_xeMatch16.12.3s

ciscoios_xeMatch16.12.4

ciscoios_xeMatch16.12.4a

ciscoios_xeMatch16.12.5

ciscoios_xeMatch16.12.5a

ciscoios_xeMatch16.12.5b

ciscoios_xeMatch16.12.6

ciscoios_xeMatch16.12.6a

ciscoios_xeMatch17.1.1

ciscoios_xeMatch17.1.1a

ciscoios_xeMatch17.1.1s

ciscoios_xeMatch17.1.1t

ciscoios_xeMatch17.1.2

ciscoios_xeMatch17.1.3

ciscoios_xeMatch17.2.1

ciscoios_xeMatch17.2.1a

ciscoios_xeMatch17.2.1r

ciscoios_xeMatch17.2.1v

ciscoios_xeMatch17.2.2

ciscoios_xeMatch17.2.3

ciscoios_xeMatch17.3.1

ciscoios_xeMatch17.3.1a

ciscoios_xeMatch17.3.1w

ciscoios_xeMatch17.3.1x

ciscoios_xeMatch17.3.1z

ciscoios_xeMatch17.3.2

ciscoios_xeMatch17.3.2a

ciscoios_xeMatch17.3.3

ciscoios_xeMatch17.3.3a

ciscoios_xeMatch17.3.4

ciscoios_xeMatch17.3.4a

ciscoios_xeMatch17.3.4b

ciscoios_xeMatch17.3.4c

ciscoios_xeMatch17.4.1

ciscoios_xeMatch17.4.1a

ciscoios_xeMatch17.4.1b

ciscoios_xeMatch17.4.1c

ciscoios_xeMatch17.4.2

ciscoios_xeMatch17.4.2a

ciscoios_xeMatch17.5.1

ciscoios_xeMatch17.5.1a

ciscoios_xeMatch17.6.1

ciscoios_xeMatch17.6.1a

ciscoios_xeMatch17.6.1w

CPENameOperatorVersion
cisco:ios_xecisco ios xeeq16.11.1
cisco:ios_xecisco ios xeeq16.11.1a
cisco:ios_xecisco ios xeeq16.11.1b
cisco:ios_xecisco ios xeeq16.11.1c
cisco:ios_xecisco ios xeeq16.11.1s
cisco:ios_xecisco ios xeeq16.11.2
cisco:ios_xecisco ios xeeq16.12.1
cisco:ios_xecisco ios xeeq16.12.1a
cisco:ios_xecisco ios xeeq16.12.1c
cisco:ios_xecisco ios xeeq16.12.1s

CPE	Name	Operator	Version
cisco:ios_xe	cisco ios xe	eq	16.11.1
cisco:ios_xe	cisco ios xe	eq	16.11.1a
cisco:ios_xe	cisco ios xe	eq	16.11.1b
cisco:ios_xe	cisco ios xe	eq	16.11.1c
cisco:ios_xe	cisco ios xe	eq	16.11.1s
cisco:ios_xe	cisco ios xe	eq	16.11.2
cisco:ios_xe	cisco ios xe	eq	16.12.1
cisco:ios_xe	cisco ios xe	eq	16.12.1a
cisco:ios_xe	cisco ios xe	eq	16.12.1c
cisco:ios_xe	cisco ios xe	eq	16.12.1s

Rows per page:

1-10 of 671

CNA Affected

[
  {
    "product": "Cisco IOS XE Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-priv-esc-ybvHKO5

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-20681

prion1 cvelist1 nvd1 cisco1 nessus1 cnvd1