Cisco Secure WSA: Authenticated Web UI Command Injection Root Escalation
CVE-2022-20871 Published on November 15, 2024
Cisco Secure Web Appliance Privilege Escalation Vulnerability
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root.
This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .
Vulnerability Analysis
CVE-2022-20871 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2022-20871 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2022-20871
Want to know whenever a new CVE is published for Cisco Asyncos? stack.watch will email you.
Affected Versions
Cisco Secure Web Appliance:- Version 12.5.3-002 is affected.
- Version 14.1.0-032 is affected.
- Version 14.1.0-047 is affected.
- Version 14.1.0-041 is affected.
- Version 14.0.2-012 is affected.
- Version 12.5.1-011 is affected.
- Version 12.5.2-007 is affected.
- Version 12.5.2-011 is affected.
- Version 14.5.0-498 is affected.
- Version 12.5.4-005 is affected.
- Version 12.5.4-011 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.