CVE-2022-20727

Published: Apr 15, 2022Modified: Nov 21, 2024

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.

Affected (214)

Products: Cisco: Cgr1000 Compute Module, Ic3000 Industrial Compute Gateway, Ios, Ios Xe, Ir510 Operating System

Cisco

5 products

Cgr1000 Compute Module

Ic3000 Industrial Compute Gateway

Ios

Ios Xe

Ir510 Operating System

Configuration A

214 vulnerable

Vulnerable Software	Affected Versions
Cisco Cgr1000 Compute Module	Before 1.15.0.1
Cisco Ic3000 Industrial Compute Gateway	Before 1.4.1
Cisco Ios	Version 15.2(5)e1
Cisco Ios	Version 15.2(6)e0a
Cisco Ios	Version 15.2(6)e1
Cisco Ios	Version 15.2(6)e2a
Cisco Ios	Version 15.2(7)e0b
Cisco Ios	Version 15.2(7)e0s
Cisco Ios	Version 15.2(7)e
Cisco Ios	Version 15.6(1)t1
Cisco Ios	Version 15.6(1)t2
Cisco Ios	Version 15.6(1)t3
Cisco Ios	Version 15.6(2)t0a
Cisco Ios	Version 15.6(2)t1
Cisco Ios	Version 15.6(2)t2
Cisco Ios	Version 15.6(2)t3
Cisco Ios	Version 15.6(2)t
Cisco Ios	Version 15.6(3)m0a
Cisco Ios	Version 15.6(3)m1
Cisco Ios	Version 15.6(3)m1a
Cisco Ios	Version 15.6(3)m1b
Cisco Ios	Version 15.6(3)m2
Cisco Ios	Version 15.6(3)m2a
Cisco Ios	Version 15.6(3)m3
Cisco Ios	Version 15.6(3)m3a
Cisco Ios	Version 15.6(3)m4
Cisco Ios	Version 15.6(3)m5
Cisco Ios	Version 15.6(3)m6
Cisco Ios	Version 15.6(3)m6a
Cisco Ios	Version 15.6(3)m6b
Cisco Ios	Version 15.6(3)m7
Cisco Ios	Version 15.6(3)m8
Cisco Ios	Version 15.6(3)m9
Cisco Ios	Version 15.6(3)m
Cisco Ios	Version 15.7(3)m0a
Cisco Ios	Version 15.7(3)m1
Cisco Ios	Version 15.7(3)m2
Cisco Ios	Version 15.7(3)m3
Cisco Ios	Version 15.7(3)m4
Cisco Ios	Version 15.7(3)m4a
Cisco Ios	Version 15.7(3)m4b
Cisco Ios	Version 15.7(3)m5
Cisco Ios	Version 15.7(3)m6
Cisco Ios	Version 15.7(3)m7
Cisco Ios	Version 15.7(3)m8
Cisco Ios	Version 15.7(3)m9
Cisco Ios	Version 15.7(3)m
Cisco Ios	Version 15.8(3)m0a
Cisco Ios	Version 15.8(3)m0b
Cisco Ios	Version 15.8(3)m1
Cisco Ios	Version 15.8(3)m1a
Cisco Ios	Version 15.8(3)m2
Cisco Ios	Version 15.8(3)m2a
Cisco Ios	Version 15.8(3)m3
Cisco Ios	Version 15.8(3)m3a
Cisco Ios	Version 15.8(3)m3b
Cisco Ios	Version 15.8(3)m4
Cisco Ios	Version 15.8(3)m5
Cisco Ios	Version 15.8(3)m6
Cisco Ios	Version 15.8(3)m7
Cisco Ios	Version 15.8(3)m
Cisco Ios	Version 15.9(3)m0a
Cisco Ios	Version 15.9(3)m1
Cisco Ios	Version 15.9(3)m2
Cisco Ios	Version 15.9(3)m2a
Cisco Ios	Version 15.9(3)m3
Cisco Ios	Version 15.9(3)m3a
Cisco Ios	Version 15.9(3)m3b
Cisco Ios	Version 15.9(3)m4
Cisco Ios	Version 15.9(3)m4a
Cisco Ios	Version 15.9(3)m
Cisco Ios Xe	Version 16.10.1
Cisco Ios Xe	Version 16.10.1a
Cisco Ios Xe	Version 16.10.1b
Cisco Ios Xe	Version 16.10.1c
Cisco Ios Xe	Version 16.10.1d
Cisco Ios Xe	Version 16.10.1e
Cisco Ios Xe	Version 16.10.1f
Cisco Ios Xe	Version 16.10.1g
Cisco Ios Xe	Version 16.10.1s
Cisco Ios Xe	Version 16.10.2
Cisco Ios Xe	Version 16.10.3
Cisco Ios Xe	Version 16.11.1
Cisco Ios Xe	Version 16.11.1a
Cisco Ios Xe	Version 16.11.1b
Cisco Ios Xe	Version 16.11.1c
Cisco Ios Xe	Version 16.11.1s
Cisco Ios Xe	Version 16.11.2
Cisco Ios Xe	Version 16.12.1
Cisco Ios Xe	Version 16.12.1a
Cisco Ios Xe	Version 16.12.1c
Cisco Ios Xe	Version 16.12.1s
Cisco Ios Xe	Version 16.12.1t
Cisco Ios Xe	Version 16.12.1w
Cisco Ios Xe	Version 16.12.1x
Cisco Ios Xe	Version 16.12.1y
Cisco Ios Xe	Version 16.12.2
Cisco Ios Xe	Version 16.12.2a
Cisco Ios Xe	Version 16.12.2s
Cisco Ios Xe	Version 16.12.2t
Cisco Ios Xe	Version 16.12.3
Cisco Ios Xe	Version 16.12.3a
Cisco Ios Xe	Version 16.12.3s
Cisco Ios Xe	Version 16.12.4
Cisco Ios Xe	Version 16.12.4a
Cisco Ios Xe	Version 16.12.5
Cisco Ios Xe	Version 16.12.5a
Cisco Ios Xe	Version 16.3.10
Cisco Ios Xe	Version 16.3.11
Cisco Ios Xe	Version 16.3.1
Cisco Ios Xe	Version 16.3.1a
Cisco Ios Xe	Version 16.3.2
Cisco Ios Xe	Version 16.3.3
Cisco Ios Xe	Version 16.3.4
Cisco Ios Xe	Version 16.3.5
Cisco Ios Xe	Version 16.3.5b
Cisco Ios Xe	Version 16.3.6
Cisco Ios Xe	Version 16.3.7
Cisco Ios Xe	Version 16.3.8
Cisco Ios Xe	Version 16.3.9
Cisco Ios Xe	Version 16.4.1
Cisco Ios Xe	Version 16.4.2
Cisco Ios Xe	Version 16.4.3
Cisco Ios Xe	Version 16.5.1
Cisco Ios Xe	Version 16.5.1a
Cisco Ios Xe	Version 16.5.1b
Cisco Ios Xe	Version 16.5.2
Cisco Ios Xe	Version 16.5.3
Cisco Ios Xe	Version 16.6.10
Cisco Ios Xe	Version 16.6.1
Cisco Ios Xe	Version 16.6.2
Cisco Ios Xe	Version 16.6.3
Cisco Ios Xe	Version 16.6.4
Cisco Ios Xe	Version 16.6.4a
Cisco Ios Xe	Version 16.6.4s
Cisco Ios Xe	Version 16.6.5
Cisco Ios Xe	Version 16.6.5a
Cisco Ios Xe	Version 16.6.5b
Cisco Ios Xe	Version 16.6.6
Cisco Ios Xe	Version 16.6.7
Cisco Ios Xe	Version 16.6.7a
Cisco Ios Xe	Version 16.6.8
Cisco Ios Xe	Version 16.6.9
Cisco Ios Xe	Version 16.7.1
Cisco Ios Xe	Version 16.7.1a
Cisco Ios Xe	Version 16.7.1b
Cisco Ios Xe	Version 16.7.2
Cisco Ios Xe	Version 16.7.3
Cisco Ios Xe	Version 16.7.4
Cisco Ios Xe	Version 16.8.1
Cisco Ios Xe	Version 16.8.1a
Cisco Ios Xe	Version 16.8.1b
Cisco Ios Xe	Version 16.8.1c
Cisco Ios Xe	Version 16.8.1d
Cisco Ios Xe	Version 16.8.1e
Cisco Ios Xe	Version 16.8.1s
Cisco Ios Xe	Version 16.8.2
Cisco Ios Xe	Version 16.8.3
Cisco Ios Xe	Version 16.9.1
Cisco Ios Xe	Version 16.9.1a
Cisco Ios Xe	Version 16.9.1b
Cisco Ios Xe	Version 16.9.1c
Cisco Ios Xe	Version 16.9.1d
Cisco Ios Xe	Version 16.9.1s
Cisco Ios Xe	Version 16.9.2
Cisco Ios Xe	Version 16.9.2a
Cisco Ios Xe	Version 16.9.2s
Cisco Ios Xe	Version 16.9.3
Cisco Ios Xe	Version 16.9.3a
Cisco Ios Xe	Version 16.9.3h
Cisco Ios Xe	Version 16.9.3s
Cisco Ios Xe	Version 16.9.4
Cisco Ios Xe	Version 16.9.4c
Cisco Ios Xe	Version 16.9.5
Cisco Ios Xe	Version 16.9.5f
Cisco Ios Xe	Version 16.9.6
Cisco Ios Xe	Version 16.9.7
Cisco Ios Xe	Version 16.9.8
Cisco Ios Xe	Version 17.1.1
Cisco Ios Xe	Version 17.1.1a
Cisco Ios Xe	Version 17.1.1s
Cisco Ios Xe	Version 17.1.1t
Cisco Ios Xe	Version 17.1.2
Cisco Ios Xe	Version 17.1.3
Cisco Ios Xe	Version 17.2.1
Cisco Ios Xe	Version 17.2.1a
Cisco Ios Xe	Version 17.2.1r
Cisco Ios Xe	Version 17.2.1v
Cisco Ios Xe	Version 17.2.2
Cisco Ios Xe	Version 17.2.3
Cisco Ios Xe	Version 17.3.1
Cisco Ios Xe	Version 17.3.1a
Cisco Ios Xe	Version 17.3.1w
Cisco Ios Xe	Version 17.3.1x
Cisco Ios Xe	Version 17.3.1z
Cisco Ios Xe	Version 17.3.2
Cisco Ios Xe	Version 17.3.2a
Cisco Ios Xe	Version 17.3.3
Cisco Ios Xe	Version 17.3.3a
Cisco Ios Xe	Version 17.3.4
Cisco Ios Xe	Version 17.3.4a
Cisco Ios Xe	Version 17.3.4b
Cisco Ios Xe	Version 17.3.4c
Cisco Ios Xe	Version 17.4.1
Cisco Ios Xe	Version 17.4.1a
Cisco Ios Xe	Version 17.4.1b
Cisco Ios Xe	Version 17.4.1c
Cisco Ios Xe	Version 17.4.2
Cisco Ios Xe	Version 17.4.2a
Cisco Ios Xe	Version 17.5.1
Cisco Ios Xe	Version 17.5.1a
Cisco Ios Xe	Version 17.6.1
Cisco Ios Xe	Version 17.6.1a
Cisco Ir510 Operating System	Before 6.5.9

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj

Source: psirt@cisco.com

Vendor Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.