High severity · published Apr 15, 2022
CVE-2022-20726
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host…
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Cgr1000 Compute Module · Cisco
All versions, or not specified · source: NVD
II
Ic3000 Industrial Compute Gateway · Cisco
All versions, or not specified · source: NVD
IO
Ios · Cisco
15.2(5)e1; 15.2(5)e2c; 15.2(6)e0a; 15.2(6)e1; 15.2(6)e2a; 15.2(7)e; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-20726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-20726
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj
More from Cgr1000 Compute Module
6.7
CVE-2022-20727
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host…
5.3
CVE-2022-20724
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host…
4.8
CVE-2022-20725
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host…