CVE-2022-20851: Cisco IOS XE Software Web UI Command Injection Vulnerability

Published Sep 30, 2022

Updated

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To exploit this vulnerability, an attacker must have valid Administrator privileges on the affected device.

Affected Software

259 affected components

Cisco IOS XE=17.6.1

cisco 1000 Integrated Services Router

cisco 1100-4g Integrated Services Router

cisco 1100-4p Integrated Services Router

cisco 1100-6g Integrated Services Router

cisco 1100-8p Integrated Services Router

cisco 1100 Integrated Services Router

cisco 1101-4p Integrated Services Router

cisco 1101 Integrated Services Router

cisco 1109-2p Integrated Services Router

cisco 1109-4p Integrated Services Router

cisco 1109 Integrated Services Router

cisco 1111x-8p Integrated Services Router

cisco 1111x Integrated Services Router

cisco 111x Integrated Services Router

cisco 1120 Integrated Services Router

cisco 1131 Integrated Services Router

cisco 1160 Integrated Services Router

Cisco 4000 Integrated Services Router

cisco 4221 Integrated Services Router

cisco 4321 Integrated Services Router

cisco 4331 Integrated Services Router

cisco 4351 Integrated Services Router

cisco 4431 Integrated Services Router

cisco 4451-x Integrated Services Router

cisco 4451 Integrated Services Router

cisco 4461 Integrated Services Router

Cisco 8101-32fh

cisco 8101-32h

cisco 8102-64h

cisco 8201

cisco 8201-32fh

cisco 8202

cisco 8800 12-slot

cisco 8800 18-slot

cisco 8800 4-slot

cisco 8800 8-slot

cisco 8804

cisco 8808

cisco 8812

cisco 8818

cisco 8831

cisco Asr 1000-esp100

cisco Asr 1000-x

cisco Asr 1001

cisco Asr 1001-hx

cisco Asr 1001-hx R

cisco Asr 1001-x

cisco Asr 1001-x R

cisco Asr 1002

cisco Asr 1002-hx

cisco Asr 1002-hx R

cisco Asr 1002-x

cisco Asr 1002-x R

cisco Asr 1002 Fixed Router

cisco Asr 1004

cisco Asr 1006

cisco Asr 1006-x

cisco Asr 1009-x

cisco Asr 1013

cisco Asr 1023

cisco Catalyst 3650

cisco Catalyst 3650-12x48fd-e

cisco Catalyst 3650-12x48fd-l

Cisco Catalyst 3650-12x48fd-s

cisco Catalyst 3650-12x48uq

cisco Catalyst 3650-12x48uq-e

cisco Catalyst 3650-12x48uq-l

cisco Catalyst 3650-12x48uq-s

cisco Catalyst 3650-12x48ur

cisco Catalyst 3650-12x48ur-e

Cisco Catalyst 3650-12x48ur-l

cisco Catalyst 3650-12x48ur-s

cisco Catalyst 3650-12x48uz

cisco Catalyst 3650-12x48uz-e

cisco Catalyst 3650-12x48uz-l

cisco Catalyst 3650-12x48uz-s

cisco Catalyst 3650-24pd

cisco Catalyst 3650-24pd-e

cisco Catalyst 3650-24pd-l

cisco Catalyst 3650-24pd-s

cisco Catalyst 3650-24pdm

cisco Catalyst 3650-24pdm-e

cisco Catalyst 3650-24pdm-l

cisco Catalyst 3650-24pdm-s

cisco Catalyst 3650-24ps-e

cisco Catalyst 3650-24ps-l

cisco Catalyst 3650-24ps-s

cisco Catalyst 3650-24td-e

cisco Catalyst 3650-24td-l

cisco Catalyst 3650-24td-s

cisco Catalyst 3650-24ts-e

cisco Catalyst 3650-24ts-l

cisco Catalyst 3650-24ts-s

cisco Catalyst 3650-48fd-e

Cisco Catalyst 3650-48fd-l

cisco Catalyst 3650-48fd-s

cisco Catalyst 3650-48fq

cisco Catalyst 3650-48fq-e

cisco Catalyst 3650-48fq-l

cisco Catalyst 3650-48fq-s

cisco Catalyst 3650-48fqm

cisco Catalyst 3650-48fqm-e

cisco Catalyst 3650-48fqm-l

Cisco Catalyst 3650-48fqm-s

cisco Catalyst 3650-48fs-e

Cisco Catalyst 3650-48fs-l

cisco Catalyst 3650-48fs-s

cisco Catalyst 3650-48pd-e

cisco Catalyst 3650-48pd-l

cisco Catalyst 3650-48pd-s

cisco Catalyst 3650-48pq-e

cisco Catalyst 3650-48pq-l

cisco Catalyst 3650-48pq-s

cisco Catalyst 3650-48ps-e

cisco Catalyst 3650-48ps-l

cisco Catalyst 3650-48ps-s

cisco Catalyst 3650-48td-e

cisco Catalyst 3650-48td-l

cisco Catalyst 3650-48td-s

cisco Catalyst 3650-48tq-e

cisco Catalyst 3650-48tq-l

cisco Catalyst 3650-48tq-s

Cisco Catalyst 3650-48ts-e

cisco Catalyst 3650-48ts-l

cisco Catalyst 3650-48ts-s

cisco Catalyst 3650-8x24pd-e

cisco Catalyst 3650-8x24pd-l

cisco Catalyst 3650-8x24pd-s

cisco Catalyst 3650-8x24uq

cisco Catalyst 3650-8x24uq-e

cisco Catalyst 3650-8x24uq-l

cisco Catalyst 3650-8x24uq-s

Cisco Catalyst 3850

Cisco Catalyst 3850-12s-e

cisco Catalyst 3850-12s-s

cisco Catalyst 3850-12x48u

cisco Catalyst 3850-12xs-e

cisco Catalyst 3850-12xs-s

Cisco Catalyst 3850-16xs-e

cisco Catalyst 3850-16xs-s

cisco Catalyst 3850-24p-e

cisco Catalyst 3850-24p-l

cisco Catalyst 3850-24p-s

cisco Catalyst 3850-24pw-s

cisco Catalyst 3850-24s-e

cisco Catalyst 3850-24s-s

cisco Catalyst 3850-24t-e

Cisco Catalyst 3850-24t-l

cisco Catalyst 3850-24t-s

cisco Catalyst 3850-24u

cisco Catalyst 3850-24u-e

cisco Catalyst 3850-24u-l

cisco Catalyst 3850-24u-s

cisco Catalyst 3850-24xs

cisco Catalyst 3850-24xs-e

cisco Catalyst 3850-24xs-s

cisco Catalyst 3850-24xu

cisco Catalyst 3850-24xu-e

cisco Catalyst 3850-24xu-l

cisco Catalyst 3850-24xu-s

cisco Catalyst 3850-32xs-e

cisco Catalyst 3850-32xs-s

cisco Catalyst 3850-48f-e

cisco Catalyst 3850-48f-l

cisco Catalyst 3850-48f-s

cisco Catalyst 3850-48p-e

cisco Catalyst 3850-48p-l

cisco Catalyst 3850-48p-s

cisco Catalyst 3850-48pw-s

Cisco Catalyst 3850-48t-e

cisco Catalyst 3850-48t-l

cisco Catalyst 3850-48t-s

cisco Catalyst 3850-48u

cisco Catalyst 3850-48u-e

cisco Catalyst 3850-48u-l

cisco Catalyst 3850-48u-s

cisco Catalyst 3850-48xs

cisco Catalyst 3850-48xs-e

cisco Catalyst 3850-48xs-f-e

cisco Catalyst 3850-48xs-f-s

cisco Catalyst 3850-48xs-s

cisco Catalyst 3850-nm-2-40g

cisco Catalyst 3850-nm-8-10g

cisco Catalyst 8200

cisco Catalyst 8300

Cisco Catalyst 8300-1n1s-4t2x

cisco Catalyst 8300-1n1s-6t

cisco Catalyst 8300-2n2s-4t2x

cisco Catalyst 8300-2n2s-6t

Cisco Catalyst 8500

Cisco Catalyst 8500-4qc

Cisco Catalyst 8500l

cisco Catalyst 8510csr

Cisco Catalyst 8510msr

cisco Catalyst 8540csr

cisco Catalyst 8540msr

cisco Catalyst 9200

cisco Catalyst 9200cx

Cisco Catalyst 9200l

Cisco Catalyst 9300

cisco Catalyst 9300-24p-a

cisco Catalyst 9300-24p-e

cisco Catalyst 9300-24s-a

cisco Catalyst 9300-24s-e

cisco Catalyst 9300-24t-a

cisco Catalyst 9300-24t-e

cisco Catalyst 9300-24u-a

cisco Catalyst 9300-24u-e

Cisco Catalyst 9300-24ux-a

Cisco Catalyst 9300-24ux-e

Cisco Catalyst 9300-48p-a

Cisco Catalyst 9300-48p-e

cisco Catalyst 9300-48s-a

cisco Catalyst 9300-48s-e

cisco Catalyst 9300-48t-a

Cisco Catalyst 9300-48t-e

cisco Catalyst 9300-48u-a

Cisco Catalyst 9300-48u-e

cisco Catalyst 9300-48un-a

cisco Catalyst 9300-48un-e

cisco Catalyst 9300-48uxm-a

cisco Catalyst 9300-48uxm-e

cisco Catalyst 9300L

cisco Catalyst 9300l-24p-4g-a

Cisco Catalyst 9300l-24p-4g-e

cisco Catalyst 9300l-24p-4x-a

cisco Catalyst 9300l-24p-4x-e

Cisco Catalyst 9300l-24t-4g-a

cisco Catalyst 9300l-24t-4g-e

cisco Catalyst 9300l-24t-4x-a

cisco Catalyst 9300l-24t-4x-e

cisco Catalyst 9300l-48p-4g-a

Cisco Catalyst 9300l-48p-4g-e

Cisco Catalyst 9300l-48p-4x-a

Cisco Catalyst 9300l-48p-4x-e

cisco Catalyst 9300l-48t-4g-a

Cisco Catalyst 9300l-48t-4g-e

Cisco Catalyst 9300l-48t-4x-a

cisco Catalyst 9300l-48t-4x-e

cisco Catalyst 9300l Stack

Cisco Catalyst 9300lm

cisco Catalyst 9300x

Cisco Catalyst 9400

cisco Catalyst 9400 Supervisor Engine-1

cisco Catalyst 9407r

cisco Catalyst 9410r

Cisco Catalyst 9500

cisco Catalyst 9500h

cisco Catalyst 9600

cisco Catalyst 9600 Supervisor Engine-1

cisco Catalyst 9600x

Cisco Catalyst 9800

Cisco Catalyst 9800-40

Cisco Catalyst 9800-80

Cisco Catalyst 9800-cl

Cisco Catalyst 9800-l

Cisco Catalyst 9800-l-c

Cisco Catalyst 9800-l-f

Event History

Sep 30, 2022

CVE Published

via MITRE·06:46 PM

Data Sourced

via MITRE·06:46 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-20851?

The severity of CVE-2022-20851 is classified as high due to its potential for exploitation via injection attacks.

How do I fix CVE-2022-20851?

To fix CVE-2022-20851, upgrade to a patched version of Cisco IOS XE Software as specified in the security advisory.

What kind of attack can be performed using CVE-2022-20851?

CVE-2022-20851 can be exploited to execute injection attacks on affected Cisco devices.

Which devices are affected by CVE-2022-20851?

CVE-2022-20851 affects Cisco IOS XE Software version 17.6.1 and potentially other versions if they do not include the necessary patches.

Is authentication required to exploit CVE-2022-20851?

Yes, an attacker must be authenticated to exploit CVE-2022-20851.

CVE-2022-20851: Cisco IOS XE Software Web UI Command Injection Vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2022-20851?

How do I fix CVE-2022-20851?

What kind of attack can be performed using CVE-2022-20851?

Which devices are affected by CVE-2022-20851?

Is authentication required to exploit CVE-2022-20851?

Company

Resources

Contact