Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU62326
Risk: Low
CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-20677
CWE-ID:
CWE-250 - Execution with Unnecessary Privileges
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incomplete file protection for the Cisco IOx application hosting environment. A local user with privilege level 15 can execute arbitrary commands as root.
MitigationInstall updates from vendor's website.
Vulnerable software versions800 Series Industrial Integrated Services Routers: All versions
800 Series Integrated Services Routers: All versions
CGR1000 Compute Modules: All versions
Industrial Ethernet 4000 Series Switches: All versions
Cisco 1000 Series Integrated Services Routers: All versions
4000 Series Integrated Services Routers: All versions
Cisco ASR 1000 Series Aggregation Services Routers: All versions
Catalyst 9x00 Series Switches: All versions
Catalyst IE3400 Rugged Series: All versions
Embedded Services 3300 Series Switches: All versions
IR510 WPAN Industrial Routers: All versions
Cisco IOS XE: before 17.7(1)
Cisco IOS: before 15.9(3)M5
Cisco IOx: before 1.15.0.1
IC3000 Industrial Compute Gateway: before 1.4.1
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.