Lucene search

CiscoCVE-2022-20726

HistoryApr 15, 2022 - 3:15 p.m.

CVE-2022-20726

2022-04-1515:15:13

CWE-755

CWE-22

cisco

web.nvd.nist.gov

cisco

iox

application hosting

vulnerability

cisco platforms

arbitrary commands

code execution

authentication

cross-site scripting

xss

nvd

cve-2022-20726

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

38.1%

JSON

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

Nvd

Node

ciscocgr1000_compute_module

ciscoic3000_industrial_compute_gateway

ciscoios

ciscoiosMatch15.2\(5\)e1

ciscoiosMatch15.2\(5\)e2c

ciscoiosMatch15.2\(6\)e0a

ciscoiosMatch15.2\(6\)e1

ciscoiosMatch15.2\(6\)e2a

ciscoiosMatch15.2\(7\)e

ciscoiosMatch15.2\(7\)e0b

ciscoiosMatch15.2\(7\)e0s

ciscoiosMatch15.6\(1\)t1

ciscoiosMatch15.6\(1\)t2

ciscoiosMatch15.6\(1\)t3

ciscoiosMatch15.6\(2\)t

ciscoiosMatch15.6\(2\)t1

ciscoiosMatch15.6\(2\)t2

ciscoiosMatch15.6\(2\)t3

ciscoiosMatch15.6\(3\)m

ciscoiosMatch15.6\(3\)m0a

ciscoiosMatch15.6\(3\)m1

ciscoiosMatch15.6\(3\)m1b

ciscoiosMatch15.6\(3\)m2

ciscoiosMatch15.6\(3\)m3

ciscoiosMatch15.6\(3\)m3a

ciscoiosMatch15.6\(3\)m4

ciscoiosMatch15.6\(3\)m5

ciscoiosMatch15.6\(3\)m6

ciscoiosMatch15.6\(3\)m6a

ciscoiosMatch15.6\(3\)m6b

ciscoiosMatch15.6\(3\)m7

ciscoiosMatch15.6\(3\)m8

ciscoiosMatch15.7\(3\)m

ciscoiosMatch15.7\(3\)m0a

ciscoiosMatch15.7\(3\)m1

ciscoiosMatch15.7\(3\)m2

ciscoiosMatch15.7\(3\)m3

ciscoiosMatch15.7\(3\)m4

ciscoiosMatch15.7\(3\)m4a

ciscoiosMatch15.7\(3\)m4b

ciscoiosMatch15.7\(3\)m5

ciscoiosMatch15.7\(3\)m6

ciscoiosMatch15.8\(3\)m

ciscoiosMatch15.8\(3\)m0a

ciscoiosMatch15.8\(3\)m1

ciscoiosMatch15.8\(3\)m2

ciscoiosMatch15.8\(3\)m2a

ciscoiosMatch15.8\(3\)m3

ciscoiosMatch15.8\(3\)m4

ciscoiosMatch15.8\(3\)m5

ciscoiosMatch15.8\(3\)m6

ciscoiosMatch15.8\(3\)m7

ciscoiosMatch15.9\(3\)m

ciscoiosMatch15.9\(3\)m1

ciscoiosMatch15.9\(3\)m2

ciscoiosMatch15.9\(3\)m2a

ciscoiosMatch15.9\(3\)m3

ciscoiosMatch15.9\(3\)m4

ciscoiosMatch15.9\(3\)m4a

VendorProductVersionCPE
ciscocgr1000_compute_module*cpe:2.3:a:cisco:cgr1000_compute_module:*:*:*:*:*:*:*:*
ciscoic3000_industrial_compute_gateway*cpe:2.3:a:cisco:ic3000_industrial_compute_gateway:*:*:*:*:*:*:*:*
ciscoios*cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
ciscoios15.2(5)e1cpe:2.3:o:cisco:ios:15.2\(5\)e1:*:*:*:*:*:*:*
ciscoios15.2(5)e2ccpe:2.3:o:cisco:ios:15.2\(5\)e2c:*:*:*:*:*:*:*
ciscoios15.2(6)e0acpe:2.3:o:cisco:ios:15.2\(6\)e0a:*:*:*:*:*:*:*
ciscoios15.2(6)e1cpe:2.3:o:cisco:ios:15.2\(6\)e1:*:*:*:*:*:*:*
ciscoios15.2(6)e2acpe:2.3:o:cisco:ios:15.2\(6\)e2a:*:*:*:*:*:*:*
ciscoios15.2(7)ecpe:2.3:o:cisco:ios:15.2\(7\)e:*:*:*:*:*:*:*
ciscoios15.2(7)e0bcpe:2.3:o:cisco:ios:15.2\(7\)e0b:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	cgr1000_compute_module	*	cpe:2.3:a:cisco:cgr1000_compute_module::::::::
cisco	ic3000_industrial_compute_gateway	*	cpe:2.3:a:cisco:ic3000_industrial_compute_gateway::::::::
cisco	ios	*	cpe:2.3:o:cisco:ios::::::::
cisco	ios	15.2(5)e1	cpe:2.3:o:cisco:ios:15.2\(5\)e1:::::::*
cisco	ios	15.2(5)e2c	cpe:2.3:o:cisco:ios:15.2\(5\)e2c:::::::*
cisco	ios	15.2(6)e0a	cpe:2.3:o:cisco:ios:15.2\(6\)e0a:::::::*
cisco	ios	15.2(6)e1	cpe:2.3:o:cisco:ios:15.2\(6\)e1:::::::*
cisco	ios	15.2(6)e2a	cpe:2.3:o:cisco:ios:15.2\(6\)e2a:::::::*
cisco	ios	15.2(7)e	cpe:2.3:o:cisco:ios:15.2\(7\)e:::::::*
cisco	ios	15.2(7)e0b	cpe:2.3:o:cisco:ios:15.2\(7\)e0b:::::::*

Rows per page:

1-10 of 591

CNA Affected

[
  {
    "product": "Cisco IOS",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

38.1%

JSON

Related for CVE-2022-20726