CVE-2022-20810 MEDIUM

CVE-2022-20810: Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure Vulnerability

Vendor Cisco
Product Cisco IOS XE Software
Weakness CWE-202
Published September 30, 2022
Last update November 1, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A vulnerability in the Simple Network Management Protocol (SNMP) of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authenticated, remote attacker to access sensitive information. This vulnerability is due to insufficient restrictions that allow a sensitive configuration detail to be disclosed. An attacker could exploit this vulnerability by retrieving data through SNMP read-only community access. A successful exploit could allow the attacker to view Service Set Identifier (SSID) preshared keys (PSKs) that are configured on the affected device.

Key dates

02Disclosure timeline

September 30, 2022 CVE published
November 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-20747 Cisco SD-WAN vManage Software Information Disclosure Vulnerability CVE-2026-30778 Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. CVE-2021-34782 Cisco DNA Center Information Disclosure Vulnerability CVE-2021-32743 Passwords used to access external services inadvertently exposed through API CVE-2026-3546 e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action