Vulnslist

Cisco vulnerabilities by product, model, software, and advisory.

Multiple Cisco Products CLI Command Injection Vulnerability

cisco-sa-cli-cmdinj-4MttWZPB · High · Published · Updated

A vulnerability in the implementation of the CLI for multiple Cisco products could allow an authenticated, local attacker to perform a command injection attack.  This vulnerability is due to insufficient validation of a process argument on an affected product. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the management framework process, which are commonly root privileges.  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB

Cisco advisory · CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2022-20655
Cisco Bug IDsCSCvq22323, CSCvq58164, CSCvq58224, CSCvq58168, CSCvq58183, CSCvq58226, CSCvz49669, CSCvq58204, CSCvm76596, CSCvq21764
CVSS ScoreBase 8.8
Base 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco IOS XR Software, Cisco Virtual Topology System (VTS), Cisco Network Services Orchestrator, Cisco Enterprise NFV Infrastructure Software, Cisco Catalyst SD-WAN, Cisco Catalyst SD-WAN Manager, Cisco SD-WAN vEdge Router, Cisco ConfD, Cisco Ultra Gateway Platform, Cisco Carrier Packet Transport, Cisco IOS XE Catalyst SD-WAN 16.9.1, Cisco IOS XE Catalyst SD-WAN 16.9.2, Cisco IOS XE Catalyst SD-WAN 16.9.3, Cisco IOS XE Catalyst SD-WAN 16.9.4, Cisco IOS XE Catalyst SD-WAN 16.10.1, Cisco IOS XE Catalyst SD-WAN 16.11.1a, Cisco IOS XE Catalyst SD-WAN 16.11.1b, Cisco IOS XE Catalyst SD-WAN 16.11.1f, Cisco IOS XE Catalyst SD-WAN

Related Products

Product CVE Evidence
Cisco Ultra Gateway Platform CVE-2022-20655 Cisco OpenVuln
Cisco IOS CVE-2022-20655 Cisco OpenVuln
Cisco Integrated Services Virtual Router CVE-2022-20655 Cisco OpenVuln
Cisco 4000 Series Integrated Services Routers CVE-2022-20655 Cisco OpenVuln
Cisco 1000 Series Integrated Services Routers CVE-2022-20655 Cisco OpenVuln
Cisco Cloud Services Router 1000V Series CVE-2022-20655 Cisco OpenVuln
Cisco Virtual Topology System (VTS) CVE-2022-20655 Cisco OpenVuln
Cisco SD-WAN vEdge Router CVE-2022-20655 Cisco OpenVuln
Cisco Network Services Orchestrator CVE-2022-20655 Cisco OpenVuln
Cisco IOS XR Software CVE-2022-20655 Cisco OpenVuln
Cisco IOS XE Catalyst SD-WAN CVE-2022-20655 Cisco OpenVuln
Cisco Enterprise NFV Infrastructure Software CVE-2022-20655 Cisco OpenVuln
Cisco ConfD CVE-2022-20655 Cisco OpenVuln
Cisco Catalyst SD-WAN Manager CVE-2022-20655 Cisco OpenVuln
Cisco Catalyst SD-WAN CVE-2022-20655 Cisco OpenVuln
Cisco Carrier Packet Transport CVE-2022-20655 Cisco OpenVuln
Cisco ASR 1000 Series Aggregation Services Routers CVE-2022-20655 Cisco OpenVuln
Cisco Catalyst 9600 Series Switches CVE-2022-20655 Cisco OpenVuln · software-dependent
Cisco Catalyst 9500 Series Switches CVE-2022-20655 Cisco OpenVuln · software-dependent
Cisco Catalyst 9400 Series Switches CVE-2022-20655 Cisco OpenVuln · software-dependent
Cisco Catalyst 9200 Series Switches CVE-2022-20655 Cisco OpenVuln · software-dependent
Cisco Catalyst 9300 Series Switches CVE-2022-20655 Cisco OpenVuln · software-dependent