Lucene search

[email protected]CVE-2022-20725

HistoryApr 15, 2022 - 3:15 p.m.

CVE-2022-20725

2022-04-1515:15:13

CWE-22

CWE-79

[email protected]

web.nvd.nist.gov

cisco

iox

application hosting

environment

vulnerabilities

cisco platforms

arbitrary commands

code execution

authentication

cross-site scripting

xss

nvd

cve-2022-20725

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.0%

JSON

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

NVD

Node

ciscocgr1000_compute_module

ciscoic3000_industrial_compute_gateway

ciscoir510_operating_system

ciscoiosMatch15.2\(5\)e1

ciscoiosMatch15.2\(5\)e2c

ciscoiosMatch15.2\(6\)e0a

ciscoiosMatch15.2\(6\)e1

ciscoiosMatch15.2\(6\)e2a

ciscoiosMatch15.2\(7\)e

ciscoiosMatch15.2\(7\)e0b

ciscoiosMatch15.2\(7\)e0s

ciscoiosMatch15.6\(1\)t1

ciscoiosMatch15.6\(1\)t2

ciscoiosMatch15.6\(1\)t3

ciscoiosMatch15.6\(2\)t

ciscoiosMatch15.6\(2\)t0a

ciscoiosMatch15.6\(2\)t1

ciscoiosMatch15.6\(2\)t2

ciscoiosMatch15.6\(2\)t3

ciscoiosMatch15.6\(3\)m

ciscoiosMatch15.6\(3\)m0a

ciscoiosMatch15.6\(3\)m1

ciscoiosMatch15.6\(3\)m1a

ciscoiosMatch15.6\(3\)m1b

ciscoiosMatch15.6\(3\)m2

ciscoiosMatch15.6\(3\)m2a

ciscoiosMatch15.6\(3\)m3

ciscoiosMatch15.6\(3\)m3a

ciscoiosMatch15.6\(3\)m4

ciscoiosMatch15.6\(3\)m5

ciscoiosMatch15.6\(3\)m6

ciscoiosMatch15.6\(3\)m6a

ciscoiosMatch15.6\(3\)m6b

ciscoiosMatch15.6\(3\)m7

ciscoiosMatch15.6\(3\)m8

ciscoiosMatch15.6\(3\)m9

ciscoiosMatch15.7\(3\)m

ciscoiosMatch15.7\(3\)m0a

ciscoiosMatch15.7\(3\)m1

ciscoiosMatch15.7\(3\)m2

ciscoiosMatch15.7\(3\)m3

ciscoiosMatch15.7\(3\)m4

ciscoiosMatch15.7\(3\)m4a

ciscoiosMatch15.7\(3\)m4b

ciscoiosMatch15.7\(3\)m5

ciscoiosMatch15.7\(3\)m6

ciscoiosMatch15.7\(3\)m7

ciscoiosMatch15.7\(3\)m8

ciscoiosMatch15.7\(3\)m9

ciscoiosMatch15.8\(3\)m

ciscoiosMatch15.8\(3\)m0a

ciscoiosMatch15.8\(3\)m0b

ciscoiosMatch15.8\(3\)m1

ciscoiosMatch15.8\(3\)m1a

ciscoiosMatch15.8\(3\)m2

ciscoiosMatch15.8\(3\)m2a

ciscoiosMatch15.8\(3\)m3

ciscoiosMatch15.8\(3\)m3a

ciscoiosMatch15.8\(3\)m3b

ciscoiosMatch15.8\(3\)m4

ciscoiosMatch15.8\(3\)m5

ciscoiosMatch15.8\(3\)m6

ciscoiosMatch15.8\(3\)m7

ciscoiosMatch15.9\(3\)m

ciscoiosMatch15.9\(3\)m0a

ciscoiosMatch15.9\(3\)m1

ciscoiosMatch15.9\(3\)m2

ciscoiosMatch15.9\(3\)m2a

ciscoiosMatch15.9\(3\)m3

ciscoiosMatch15.9\(3\)m3a

ciscoiosMatch15.9\(3\)m3b

ciscoiosMatch15.9\(3\)m4

ciscoiosMatch15.9\(3\)m4a

ciscoios_xeMatch16.3.1

ciscoios_xeMatch16.3.1a

ciscoios_xeMatch16.3.2

ciscoios_xeMatch16.3.3

ciscoios_xeMatch16.3.4

ciscoios_xeMatch16.3.5

ciscoios_xeMatch16.3.5b

ciscoios_xeMatch16.3.6

ciscoios_xeMatch16.3.7

ciscoios_xeMatch16.3.8

ciscoios_xeMatch16.3.9

ciscoios_xeMatch16.3.10

ciscoios_xeMatch16.3.11

ciscoios_xeMatch16.4.1

ciscoios_xeMatch16.4.2

ciscoios_xeMatch16.4.3

ciscoios_xeMatch16.5.1

ciscoios_xeMatch16.5.1a

ciscoios_xeMatch16.5.1b

ciscoios_xeMatch16.5.2

ciscoios_xeMatch16.5.3

ciscoios_xeMatch16.6.1

ciscoios_xeMatch16.6.2

ciscoios_xeMatch16.6.3

ciscoios_xeMatch16.6.4

ciscoios_xeMatch16.6.4a

ciscoios_xeMatch16.6.4s

ciscoios_xeMatch16.6.5

ciscoios_xeMatch16.6.5a

ciscoios_xeMatch16.6.5b

ciscoios_xeMatch16.6.6

ciscoios_xeMatch16.6.7

ciscoios_xeMatch16.6.7a

ciscoios_xeMatch16.6.8

ciscoios_xeMatch16.6.9

ciscoios_xeMatch16.6.10

ciscoios_xeMatch16.7.1

ciscoios_xeMatch16.7.1a

ciscoios_xeMatch16.7.1b

ciscoios_xeMatch16.7.2

ciscoios_xeMatch16.7.3

ciscoios_xeMatch16.7.4

ciscoios_xeMatch16.8.1

ciscoios_xeMatch16.8.1a

ciscoios_xeMatch16.8.1b

ciscoios_xeMatch16.8.1c

ciscoios_xeMatch16.8.1d

ciscoios_xeMatch16.8.1e

ciscoios_xeMatch16.8.1s

ciscoios_xeMatch16.8.2

ciscoios_xeMatch16.8.3

ciscoios_xeMatch16.9.1

ciscoios_xeMatch16.9.1a

ciscoios_xeMatch16.9.1b

ciscoios_xeMatch16.9.1c

ciscoios_xeMatch16.9.1d

ciscoios_xeMatch16.9.1s

ciscoios_xeMatch16.9.2

ciscoios_xeMatch16.9.2a

ciscoios_xeMatch16.9.2s

ciscoios_xeMatch16.9.3

ciscoios_xeMatch16.9.3a

ciscoios_xeMatch16.9.3h

ciscoios_xeMatch16.9.3s

ciscoios_xeMatch16.9.4

ciscoios_xeMatch16.9.4c

ciscoios_xeMatch16.9.5

ciscoios_xeMatch16.9.5f

ciscoios_xeMatch16.9.6

ciscoios_xeMatch16.9.7

ciscoios_xeMatch16.9.8

ciscoios_xeMatch16.10.1

ciscoios_xeMatch16.10.1a

ciscoios_xeMatch16.10.1b

ciscoios_xeMatch16.10.1c

ciscoios_xeMatch16.10.1d

ciscoios_xeMatch16.10.1e

ciscoios_xeMatch16.10.1f

ciscoios_xeMatch16.10.1g

ciscoios_xeMatch16.10.1s

ciscoios_xeMatch16.10.2

ciscoios_xeMatch16.10.3

ciscoios_xeMatch16.11.1

ciscoios_xeMatch16.11.1a

ciscoios_xeMatch16.11.1b

ciscoios_xeMatch16.11.1c

ciscoios_xeMatch16.11.1s

ciscoios_xeMatch16.11.2

ciscoios_xeMatch16.12.1

ciscoios_xeMatch16.12.1a

ciscoios_xeMatch16.12.1c

ciscoios_xeMatch16.12.1s

ciscoios_xeMatch16.12.1t

ciscoios_xeMatch16.12.1w

ciscoios_xeMatch16.12.1x

ciscoios_xeMatch16.12.1y

ciscoios_xeMatch16.12.2

ciscoios_xeMatch16.12.2a

ciscoios_xeMatch16.12.2s

ciscoios_xeMatch16.12.2t

ciscoios_xeMatch16.12.3

ciscoios_xeMatch16.12.3a

ciscoios_xeMatch16.12.3s

ciscoios_xeMatch16.12.4

ciscoios_xeMatch16.12.4a

ciscoios_xeMatch16.12.5

ciscoios_xeMatch16.12.5a

ciscoios_xeMatch17.1.1

ciscoios_xeMatch17.1.1a

ciscoios_xeMatch17.1.1s

ciscoios_xeMatch17.1.1t

ciscoios_xeMatch17.1.2

ciscoios_xeMatch17.1.3

ciscoios_xeMatch17.2.1

ciscoios_xeMatch17.2.1a

ciscoios_xeMatch17.2.1r

ciscoios_xeMatch17.2.1v

ciscoios_xeMatch17.2.2

ciscoios_xeMatch17.2.3

ciscoios_xeMatch17.3.1

ciscoios_xeMatch17.3.1a

ciscoios_xeMatch17.3.1w

ciscoios_xeMatch17.3.1x

ciscoios_xeMatch17.3.1z

ciscoios_xeMatch17.3.2

ciscoios_xeMatch17.3.2a

ciscoios_xeMatch17.3.3

ciscoios_xeMatch17.3.3a

ciscoios_xeMatch17.3.4

ciscoios_xeMatch17.3.4a

ciscoios_xeMatch17.3.4b

ciscoios_xeMatch17.3.4c

ciscoios_xeMatch17.4.1

ciscoios_xeMatch17.4.1a

ciscoios_xeMatch17.4.1b

ciscoios_xeMatch17.4.1c

ciscoios_xeMatch17.4.2

ciscoios_xeMatch17.4.2a

ciscoios_xeMatch17.5.1

ciscoios_xeMatch17.5.1a

ciscoios_xeMatch17.6.1

ciscoios_xeMatch17.6.1a

AND

cisco800m_integrated_services_routerMatch-

cisco807_industrial_integrated_services_routerMatch-

cisco812_3g_integrated_services_routerMatch-

cisco812_cifi_integrated_services_routerMatch-

cisco819_hardened_dual_radio_802.11n_wifi_integrated_services_routerMatch-

cisco819_hardened_integrated_services_routerMatch-

cisco829_industrial_integrated_services_routerMatch-

cisco860vae-w_integrated_services_routerMatch-

cisco861_integrated_services_routerMatch-

cisco861w_integrated_services_routerMatch-

cisco866vae_integrated_services_routerMatch-

cisco867_integrated_services_routerMatch-

cisco867vae_integrated_services_routerMatch-

cisco880-voice_integrated_services_routerMatch-

cisco880_3g_integrated_services_routerMatch-

cisco881-cube_integrated_services_routerMatch-

cisco881_3g_integrated_services_routerMatch-

cisco881_integrated_services_routerMatch-

cisco881w_integrated_services_routerMatch-

cisco886_integrated_services_routerMatch-

cisco886va-cube_integrated_services_routerMatch-

cisco886va-w_integrated_services_routerMatch-

cisco886va_integrated_services_routerMatch-

cisco886vag_3g_integrated_services_routerMatch-

cisco887_integrated_services_routerMatch-

cisco887v_integrated_services_routerMatch-

cisco887va-cube_integrated_services_routerMatch-

cisco887va-w_integrated_services_routerMatch-

cisco887va_integrated_services_routerMatch-

cisco887vag_3g_integrated_services_routerMatch-

cisco887vam-w_integrated_services_routerMatch-

cisco887vamg_3g_integrated_services_routerMatch-

cisco888-cube_integrated_services_routerMatch-

cisco888_integrated_services_routerMatch-

cisco888e-cube_integrated_services_routerMatch-

cisco888e_integrated_services_routerMatch-

cisco888eg_3g_integrated_services_routerMatch-

cisco888w_integrated_services_routerMatch-

cisco891-24x_integrated_services_routerMatch-

cisco891_integrated_services_routerMatch-

cisco891w_integrated_services_routerMatch-

cisco892_integrated_services_routerMatch-

cisco892f-cube_integrated_services_routerMatch-

cisco892w_integrated_services_routerMatch-

ciscocgr_1000Match-

ciscocgr_1120Match-

ciscocgr_1240Match-

ciscoic3000_industrial_compute_gatewayMatch-

ciscoie-4000-16gt4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-16t4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-4gc4gp4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-4gs8gp4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-4s8p4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-4t4p4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-4tc4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-8gs4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-8gt4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-8gt8gp4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-8s4g-e_industrial_ethernet_switchMatch-

ciscoie-4000-8t4g-e_industrial_ethernet_switchMatch-

ciscoie-4010-16s12p_industrial_ethernet_switchMatch-

ciscoie-4010-4s24p_industrial_ethernet_switchMatch-

ciscoir510_wpanMatch-

CPENameOperatorVersion
cisco:cgr1000_compute_modulecisco cgr1000 compute moduleeq*
cisco:ic3000_industrial_compute_gatewaycisco ic3000 industrial compute gatewayeq*
cisco:ir510_operating_systemcisco ir510 operating systemeq*
cisco:ioscisco ioseq15.2\(5\)e1
cisco:ioscisco ioseq15.2\(5\)e2c
cisco:ioscisco ioseq15.2\(6\)e0a
cisco:ioscisco ioseq15.2\(6\)e1
cisco:ioscisco ioseq15.2\(6\)e2a
cisco:ioscisco ioseq15.2\(7\)e
cisco:ioscisco ioseq15.2\(7\)e0b

CPE	Name	Operator	Version
cisco:cgr1000_compute_module	cisco cgr1000 compute module	eq	*
cisco:ic3000_industrial_compute_gateway	cisco ic3000 industrial compute gateway	eq	*
cisco:ir510_operating_system	cisco ir510 operating system	eq	*
cisco:ios	cisco ios	eq	15.2\(5\)e1
cisco:ios	cisco ios	eq	15.2\(5\)e2c
cisco:ios	cisco ios	eq	15.2\(6\)e0a
cisco:ios	cisco ios	eq	15.2\(6\)e1
cisco:ios	cisco ios	eq	15.2\(6\)e2a
cisco:ios	cisco ios	eq	15.2\(7\)e
cisco:ios	cisco ios	eq	15.2\(7\)e0b

Rows per page:

1-10 of 2151

CNA Affected

[
  {
    "product": "Cisco IOS ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

github.com/orangecertcc/security-research/security/advisories/GHSA-q2v9-qpmg-4qc4

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj

Social References

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.0%

JSON

Related for CVE-2022-20725

cvelist1 prion1 nvd1 nessus2 cisco1