CVE-2022-20693: Cisco IOS XE Software Web UI API Injection Vulnerability
First published: Fri Apr 15 2022(Updated: )
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Web UI | =3.15.1xbs | |
| Cisco IOS XE Web UI | =3.15.2xbs | |
| Cisco IOS XE Web UI | =16.12.1 | |
| Cisco IOS XE Web UI | =16.12.1a | |
| Cisco IOS XE Web UI | =16.12.1c | |
| Cisco IOS XE Web UI | =16.12.1s | |
| Cisco IOS XE Web UI | =16.12.1t | |
| Cisco IOS XE Web UI | =16.12.1w | |
| Cisco IOS XE Web UI | =16.12.1x | |
| Cisco IOS XE Web UI | =16.12.1y | |
| Cisco IOS XE Web UI | =16.12.1z | |
| Cisco IOS XE Web UI | =16.12.1z1 | |
| Cisco IOS XE Web UI | =16.12.1z2 | |
| Cisco IOS XE Web UI | =16.12.2 | |
| Cisco IOS XE Web UI | =16.12.2a | |
| Cisco IOS XE Web UI | =16.12.2s | |
| Cisco IOS XE Web UI | =16.12.2t | |
| Cisco IOS XE Web UI | =16.12.3 | |
| Cisco IOS XE Web UI | =16.12.3a | |
| Cisco IOS XE Web UI | =16.12.3s | |
| Cisco IOS XE Web UI | =16.12.4 | |
| Cisco IOS XE Web UI | =16.12.4a | |
| Cisco IOS XE Web UI | =16.12.5 | |
| Cisco IOS XE Web UI | =16.12.5a | |
| Cisco IOS XE Web UI | =16.12.5b | |
| Cisco IOS XE Web UI | =16.12.6 | |
| Cisco IOS XE Web UI | =16.12.6a | |
| Cisco IOS XE Web UI | =17.1.1 | |
| Cisco IOS XE Web UI | =17.1.1a | |
| Cisco IOS XE Web UI | =17.1.1s | |
| Cisco IOS XE Web UI | =17.1.1t | |
| Cisco IOS XE Web UI | =17.1.2 | |
| Cisco IOS XE Web UI | =17.1.3 | |
| Cisco IOS XE Web UI | =17.2.1 | |
| Cisco IOS XE Web UI | =17.2.1a | |
| Cisco IOS XE Web UI | =17.2.1r | |
| Cisco IOS XE Web UI | =17.2.1v | |
| Cisco IOS XE Web UI | =17.2.2 | |
| Cisco IOS XE Web UI | =17.2.3 | |
| Cisco IOS XE Web UI | =17.3.1 | |
| Cisco IOS XE Web UI | =17.3.1a | |
| Cisco IOS XE Web UI | =17.3.1w | |
| Cisco IOS XE Web UI | =17.3.1x | |
| Cisco IOS XE Web UI | =17.3.1z | |
| Cisco IOS XE Web UI | =17.3.2 | |
| Cisco IOS XE Web UI | =17.3.2a | |
| Cisco IOS XE Web UI | =17.3.3 | |
| Cisco IOS XE Web UI | =17.3.3a | |
| Cisco IOS XE Web UI | =17.3.4 | |
| Cisco IOS XE Web UI | =17.3.4a | |
| Cisco IOS XE Web UI | =17.3.4b | |
| Cisco IOS XE Web UI | =17.3.4c | |
| Cisco IOS XE Web UI | =17.4.1 | |
| Cisco IOS XE Web UI | =17.4.1a | |
| Cisco IOS XE Web UI | =17.4.1b | |
| Cisco IOS XE Web UI | =17.4.1c | |
| Cisco IOS XE Web UI | =17.4.2 | |
| Cisco IOS XE Web UI | =17.4.2a | |
| Cisco IOS XE Web UI | =17.5.1 | |
| Cisco IOS XE Web UI | =17.5.1a | |
| Cisco IOS XE Web UI | =17.6.1 | |
| Cisco IOS XE Web UI | =17.6.1a | |
| Cisco IOS XE Web UI | =17.6.1w |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-20693?
CVE-2022-20693 has a severity rating of Medium, indicating a moderate risk for exploitation.
Which Cisco IOS XE versions are affected by CVE-2022-20693?
CVE-2022-20693 affects multiple versions of Cisco IOS XE, including 3.15.1xbs, 16.12.1, 17.1.1, and various others.
How can I fix CVE-2022-20693?
To mitigate CVE-2022-20693, it is recommended to upgrade to a patched version of Cisco IOS XE that addresses the vulnerability.
What types of attacks can be executed by exploiting CVE-2022-20693?
Exploiting CVE-2022-20693 may allow an authenticated attacker to execute injection attacks against the affected device.
What are the prerequisites for exploiting CVE-2022-20693?
An attacker needs to be authenticated and have access to the web UI of the affected device to exploit CVE-2022-20693.
- agent/author
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/references
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/cisco
- canonical/cisco ios xe web ui
- version/cisco ios xe web ui/3.15.1xbs
- version/cisco ios xe web ui/3.15.2xbs
- version/cisco ios xe web ui/16.12.1
- version/cisco ios xe web ui/16.12.1a
- version/cisco ios xe web ui/16.12.1c
- version/cisco ios xe web ui/16.12.1s
- version/cisco ios xe web ui/16.12.1t
- version/cisco ios xe web ui/16.12.1w
- version/cisco ios xe web ui/16.12.1x
- version/cisco ios xe web ui/16.12.1y
- version/cisco ios xe web ui/16.12.1z
- version/cisco ios xe web ui/16.12.1z1
- version/cisco ios xe web ui/16.12.1z2
- version/cisco ios xe web ui/16.12.2
- version/cisco ios xe web ui/16.12.2a
- version/cisco ios xe web ui/16.12.2s
- version/cisco ios xe web ui/16.12.2t
- version/cisco ios xe web ui/16.12.3
- version/cisco ios xe web ui/16.12.3a
- version/cisco ios xe web ui/16.12.3s
- version/cisco ios xe web ui/16.12.4
- version/cisco ios xe web ui/16.12.4a
- version/cisco ios xe web ui/16.12.5
- version/cisco ios xe web ui/16.12.5a
- version/cisco ios xe web ui/16.12.5b
- version/cisco ios xe web ui/16.12.6
- version/cisco ios xe web ui/16.12.6a
- version/cisco ios xe web ui/17.1.1
- version/cisco ios xe web ui/17.1.1a
- version/cisco ios xe web ui/17.1.1s
- version/cisco ios xe web ui/17.1.1t
- version/cisco ios xe web ui/17.1.2
- version/cisco ios xe web ui/17.1.3
- version/cisco ios xe web ui/17.2.1
- version/cisco ios xe web ui/17.2.1a
- version/cisco ios xe web ui/17.2.1r
- version/cisco ios xe web ui/17.2.1v
- version/cisco ios xe web ui/17.2.2
- version/cisco ios xe web ui/17.2.3
- version/cisco ios xe web ui/17.3.1
- version/cisco ios xe web ui/17.3.1a
- version/cisco ios xe web ui/17.3.1w
- version/cisco ios xe web ui/17.3.1x
- version/cisco ios xe web ui/17.3.1z
- version/cisco ios xe web ui/17.3.2
- version/cisco ios xe web ui/17.3.2a
- version/cisco ios xe web ui/17.3.3
- version/cisco ios xe web ui/17.3.3a
- version/cisco ios xe web ui/17.3.4
- version/cisco ios xe web ui/17.3.4a
- version/cisco ios xe web ui/17.3.4b
- version/cisco ios xe web ui/17.3.4c
- version/cisco ios xe web ui/17.4.1
- version/cisco ios xe web ui/17.4.1a
- version/cisco ios xe web ui/17.4.1b
- version/cisco ios xe web ui/17.4.1c
- version/cisco ios xe web ui/17.4.2
- version/cisco ios xe web ui/17.4.2a
- version/cisco ios xe web ui/17.5.1
- version/cisco ios xe web ui/17.5.1a
- version/cisco ios xe web ui/17.6.1
- version/cisco ios xe web ui/17.6.1a
- version/cisco ios xe web ui/17.6.1w