CVE-2022-20693 MEDIUM

CVE-2022-20693: Cisco IOS XE Software Web UI API Injection Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-74
Published April 15, 2022
Last update November 6, 2024
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Key dates

02Disclosure timeline

April 15, 2022 CVE published
November 6, 2024 Record updated