Medium severity · published Aug 25, 2022
CVE-2022-20865
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
F4
Firepower 4110 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4112 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4115 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4120 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4125 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4140 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4145 Firmware · Cisco
All versions, or not specified · source: NVD
F4
Firepower 4150 Firmware · Cisco
All versions, or not specified · source: NVD
F9
Firepower 9300 Sm-40 Firmware · Cisco
All versions, or not specified · source: NVD
F9
Firepower 9300 Sm-48 Firmware · Cisco
All versions, or not specified · source: NVD
F9
Firepower 9300 Sm-56 Firmware · Cisco
All versions, or not specified · source: NVD
F9
Firepower 9300 Sm-56 X 3 Firmware · Cisco
All versions, or not specified · source: NVD
Affected product
F4
Firepower 4110 Firmware
Cisco
More from Firepower 4110 Firmware
8.8
CVE-2019-12675
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for…
8.2
CVE-2019-12674
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for…