CVE-2022-20693: Cisco IOS XE Software Web UI API Injection Vulnerability
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20693?
CVE-2022-20693 has a severity rating of Medium, indicating a moderate risk for exploitation.
Which Cisco IOS XE versions are affected by CVE-2022-20693?
CVE-2022-20693 affects multiple versions of Cisco IOS XE, including 3.15.1xbs, 16.12.1, 17.1.1, and various others.
How can I fix CVE-2022-20693?
To mitigate CVE-2022-20693, it is recommended to upgrade to a patched version of Cisco IOS XE that addresses the vulnerability.
What types of attacks can be executed by exploiting CVE-2022-20693?
Exploiting CVE-2022-20693 may allow an authenticated attacker to execute injection attacks against the affected device.
What are the prerequisites for exploiting CVE-2022-20693?
An attacker needs to be authenticated and have access to the web UI of the affected device to exploit CVE-2022-20693.