CVE-2022-20693
Cisco IOS XE Software Web UI API Injection Vulnerability
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 4.7EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
15 abr 2022Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Cisco · Cisco IOS XE SoftwareQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →