CVE-2022-20725

EPSS 0.76%
Published 15.04.2022 15:15:13
Last modified 21.11.2024 06:43:25
Source psirt@cisco.com
Teams watchlist Login
Open Login

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products Warnungen 0 Metrics 4 CWE 2 References 5

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Cgr1000 Compute Module

Cisco ≫ Ic3000 Industrial Compute Gateway

Cisco ≫ Ir510 Operating System

Cisco ≫ Ios Version15.2(5)e1

Cisco ≫ Ios Version15.2(5)e2c

Cisco ≫ Ios Version15.2(6)e0a

Cisco ≫ Ios Version15.2(6)e1

Cisco ≫ Ios Version15.2(6)e2a

Cisco ≫ Ios Version15.2(7)e

Cisco ≫ Ios Version15.2(7)e0b

Cisco ≫ Ios Version15.2(7)e0s

Cisco ≫ Ios Version15.6(1)t1

Cisco ≫ Ios Version15.6(1)t2

Cisco ≫ Ios Version15.6(1)t3

Cisco ≫ Ios Version15.6(2)t

Cisco ≫ Ios Version15.6(2)t0a

Cisco ≫ Ios Version15.6(2)t1

Cisco ≫ Ios Version15.6(2)t2

Cisco ≫ Ios Version15.6(2)t3

Cisco ≫ Ios Version15.6(3)m

Cisco ≫ Ios Version15.6(3)m0a

Cisco ≫ Ios Version15.6(3)m1

Cisco ≫ Ios Version15.6(3)m1a

Cisco ≫ Ios Version15.6(3)m1b

Cisco ≫ Ios Version15.6(3)m2

Cisco ≫ Ios Version15.6(3)m2a

Cisco ≫ Ios Version15.6(3)m3

Cisco ≫ Ios Version15.6(3)m3a

Cisco ≫ Ios Version15.6(3)m4

Cisco ≫ Ios Version15.6(3)m5

Cisco ≫ Ios Version15.6(3)m6

Cisco ≫ Ios Version15.6(3)m6a

Cisco ≫ Ios Version15.6(3)m6b

Cisco ≫ Ios Version15.6(3)m7

Cisco ≫ Ios Version15.6(3)m8

Cisco ≫ Ios Version15.6(3)m9

Cisco ≫ Ios Version15.7(3)m

Cisco ≫ Ios Version15.7(3)m0a

Cisco ≫ Ios Version15.7(3)m1

Cisco ≫ Ios Version15.7(3)m2

Cisco ≫ Ios Version15.7(3)m3

Cisco ≫ Ios Version15.7(3)m4

Cisco ≫ Ios Version15.7(3)m4a

Cisco ≫ Ios Version15.7(3)m4b

Cisco ≫ Ios Version15.7(3)m5

Cisco ≫ Ios Version15.7(3)m6

Cisco ≫ Ios Version15.7(3)m7

Cisco ≫ Ios Version15.7(3)m8

Cisco ≫ Ios Version15.7(3)m9

Cisco ≫ Ios Version15.8(3)m

Cisco ≫ Ios Version15.8(3)m0a

Cisco ≫ Ios Version15.8(3)m0b

Cisco ≫ Ios Version15.8(3)m1

Cisco ≫ Ios Version15.8(3)m1a

Cisco ≫ Ios Version15.8(3)m2

Cisco ≫ Ios Version15.8(3)m2a

Cisco ≫ Ios Version15.8(3)m3

Cisco ≫ Ios Version15.8(3)m3a

Cisco ≫ Ios Version15.8(3)m3b

Cisco ≫ Ios Version15.8(3)m4

Cisco ≫ Ios Version15.8(3)m5

Cisco ≫ Ios Version15.8(3)m6

Cisco ≫ Ios Version15.8(3)m7

Cisco ≫ Ios Version15.9(3)m

Cisco ≫ Ios Version15.9(3)m0a

Cisco ≫ Ios Version15.9(3)m1

Cisco ≫ Ios Version15.9(3)m2

Cisco ≫ Ios Version15.9(3)m2a

Cisco ≫ Ios Version15.9(3)m3

Cisco ≫ Ios Version15.9(3)m3a

Cisco ≫ Ios Version15.9(3)m3b

Cisco ≫ Ios Version15.9(3)m4

Cisco ≫ Ios Version15.9(3)m4a

Cisco ≫ Ios Xe Version16.3.1

Cisco ≫ Ios Xe Version16.3.1a

Cisco ≫ Ios Xe Version16.3.2

Cisco ≫ Ios Xe Version16.3.3

Cisco ≫ Ios Xe Version16.3.4

Cisco ≫ Ios Xe Version16.3.5

Cisco ≫ Ios Xe Version16.3.5b

Cisco ≫ Ios Xe Version16.3.6

Cisco ≫ Ios Xe Version16.3.7

Cisco ≫ Ios Xe Version16.3.8

Cisco ≫ Ios Xe Version16.3.9

Cisco ≫ Ios Xe Version16.3.10

Cisco ≫ Ios Xe Version16.3.11

Cisco ≫ Ios Xe Version16.4.1

Cisco ≫ Ios Xe Version16.4.2

Cisco ≫ Ios Xe Version16.4.3

Cisco ≫ Ios Xe Version16.5.1

Cisco ≫ Ios Xe Version16.5.1a

Cisco ≫ Ios Xe Version16.5.1b

Cisco ≫ Ios Xe Version16.5.2

Cisco ≫ Ios Xe Version16.5.3

Cisco ≫ Ios Xe Version16.6.1

Cisco ≫ Ios Xe Version16.6.2

Cisco ≫ Ios Xe Version16.6.3

Cisco ≫ Ios Xe Version16.6.4

Cisco ≫ Ios Xe Version16.6.4a

Cisco ≫ Ios Xe Version16.6.4s

Cisco ≫ Ios Xe Version16.6.5

Cisco ≫ Ios Xe Version16.6.5a

Cisco ≫ Ios Xe Version16.6.5b

Cisco ≫ Ios Xe Version16.6.6

Cisco ≫ Ios Xe Version16.6.7

Cisco ≫ Ios Xe Version16.6.7a

Cisco ≫ Ios Xe Version16.6.8

Cisco ≫ Ios Xe Version16.6.9

Cisco ≫ Ios Xe Version16.6.10

Cisco ≫ Ios Xe Version16.7.1

Cisco ≫ Ios Xe Version16.7.1a

Cisco ≫ Ios Xe Version16.7.1b

Cisco ≫ Ios Xe Version16.7.2

Cisco ≫ Ios Xe Version16.7.3

Cisco ≫ Ios Xe Version16.7.4

Cisco ≫ Ios Xe Version16.8.1

Cisco ≫ Ios Xe Version16.8.1a

Cisco ≫ Ios Xe Version16.8.1b

Cisco ≫ Ios Xe Version16.8.1c

Cisco ≫ Ios Xe Version16.8.1d

Cisco ≫ Ios Xe Version16.8.1e

Cisco ≫ Ios Xe Version16.8.1s

Cisco ≫ Ios Xe Version16.8.2

Cisco ≫ Ios Xe Version16.8.3

Cisco ≫ Ios Xe Version16.9.1

Cisco ≫ Ios Xe Version16.9.1a

Cisco ≫ Ios Xe Version16.9.1b

Cisco ≫ Ios Xe Version16.9.1c

Cisco ≫ Ios Xe Version16.9.1d

Cisco ≫ Ios Xe Version16.9.1s

Cisco ≫ Ios Xe Version16.9.2

Cisco ≫ Ios Xe Version16.9.2a

Cisco ≫ Ios Xe Version16.9.2s

Cisco ≫ Ios Xe Version16.9.3

Cisco ≫ Ios Xe Version16.9.3a

Cisco ≫ Ios Xe Version16.9.3h

Cisco ≫ Ios Xe Version16.9.3s

Cisco ≫ Ios Xe Version16.9.4

Cisco ≫ Ios Xe Version16.9.4c

Cisco ≫ Ios Xe Version16.9.5

Cisco ≫ Ios Xe Version16.9.5f

Cisco ≫ Ios Xe Version16.9.6

Cisco ≫ Ios Xe Version16.9.7

Cisco ≫ Ios Xe Version16.9.8

Cisco ≫ Ios Xe Version16.10.1

Cisco ≫ Ios Xe Version16.10.1a

Cisco ≫ Ios Xe Version16.10.1b

Cisco ≫ Ios Xe Version16.10.1c

Cisco ≫ Ios Xe Version16.10.1d

Cisco ≫ Ios Xe Version16.10.1e

Cisco ≫ Ios Xe Version16.10.1f

Cisco ≫ Ios Xe Version16.10.1g

Cisco ≫ Ios Xe Version16.10.1s

Cisco ≫ Ios Xe Version16.10.2

Cisco ≫ Ios Xe Version16.10.3

Cisco ≫ Ios Xe Version16.11.1

Cisco ≫ Ios Xe Version16.11.1a

Cisco ≫ Ios Xe Version16.11.1b

Cisco ≫ Ios Xe Version16.11.1c

Cisco ≫ Ios Xe Version16.11.1s

Cisco ≫ Ios Xe Version16.11.2

Cisco ≫ Ios Xe Version16.12.1

Cisco ≫ Ios Xe Version16.12.1a

Cisco ≫ Ios Xe Version16.12.1c

Cisco ≫ Ios Xe Version16.12.1s

Cisco ≫ Ios Xe Version16.12.1t

Cisco ≫ Ios Xe Version16.12.1w

Cisco ≫ Ios Xe Version16.12.1x

Cisco ≫ Ios Xe Version16.12.1y

Cisco ≫ Ios Xe Version16.12.2

Cisco ≫ Ios Xe Version16.12.2a

Cisco ≫ Ios Xe Version16.12.2s

Cisco ≫ Ios Xe Version16.12.2t

Cisco ≫ Ios Xe Version16.12.3

Cisco ≫ Ios Xe Version16.12.3a

Cisco ≫ Ios Xe Version16.12.3s

Cisco ≫ Ios Xe Version16.12.4

Cisco ≫ Ios Xe Version16.12.4a

Cisco ≫ Ios Xe Version16.12.5

Cisco ≫ Ios Xe Version16.12.5a

Cisco ≫ Ios Xe Version17.1.1

Cisco ≫ Ios Xe Version17.1.1a

Cisco ≫ Ios Xe Version17.1.1s

Cisco ≫ Ios Xe Version17.1.1t

Cisco ≫ Ios Xe Version17.1.2

Cisco ≫ Ios Xe Version17.1.3

Cisco ≫ Ios Xe Version17.2.1

Cisco ≫ Ios Xe Version17.2.1a

Cisco ≫ Ios Xe Version17.2.1r

Cisco ≫ Ios Xe Version17.2.1v

Cisco ≫ Ios Xe Version17.2.2

Cisco ≫ Ios Xe Version17.2.3

Cisco ≫ Ios Xe Version17.3.1

Cisco ≫ Ios Xe Version17.3.1a

Cisco ≫ Ios Xe Version17.3.1w

Cisco ≫ Ios Xe Version17.3.1x

Cisco ≫ Ios Xe Version17.3.1z

Cisco ≫ Ios Xe Version17.3.2

Cisco ≫ Ios Xe Version17.3.2a

Cisco ≫ Ios Xe Version17.3.3

Cisco ≫ Ios Xe Version17.3.3a

Cisco ≫ Ios Xe Version17.3.4

Cisco ≫ Ios Xe Version17.3.4a

Cisco ≫ Ios Xe Version17.3.4b

Cisco ≫ Ios Xe Version17.3.4c

Cisco ≫ Ios Xe Version17.4.1

Cisco ≫ Ios Xe Version17.4.1a

Cisco ≫ Ios Xe Version17.4.1b

Cisco ≫ Ios Xe Version17.4.1c

Cisco ≫ Ios Xe Version17.4.2

Cisco ≫ Ios Xe Version17.4.2a

Cisco ≫ Ios Xe Version17.5.1

Cisco ≫ Ios Xe Version17.5.1a

Cisco ≫ Ios Xe Version17.6.1

Cisco ≫ Ios Xe Version17.6.1a

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.76%	0.727

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.8	1.7	2.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov	3.5	6.8	2.9	AV:N/AC:M/Au:S/C:N/I:P/A:N
psirt@cisco.com	5.5	1.2	4.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj

Vendor Advisory

https://github.com/orangecertcc/security-research/security/advisories/GHSA-q2v9-qpmg-4qc4

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-20725

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-20725

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-20725

EUVD