CVE-2022-20693

MEDIUM

Cisco IOS XE - Authenticated OS Command Injection via Web UI API

Title source: llm
STIX 2.1

Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

References (1)

Core 1
Core References

Scores

CVSS v3 4.7
EPSS 0.0241
EPSS Percentile 85.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-78 CWE-74
Status published
Products (50)
cisco/ios_xe 3.15.1xbs
cisco/ios_xe 3.15.2xbs
cisco/ios_xe 16.12.1
cisco/ios_xe 16.12.1a
cisco/ios_xe 16.12.1c
cisco/ios_xe 16.12.1s
cisco/ios_xe 16.12.1t
cisco/ios_xe 16.12.1w
cisco/ios_xe 16.12.1x
cisco/ios_xe 16.12.1y
... and 40 more
Published Apr 15, 2022
Tracked Since Feb 18, 2026