Information disclosure in Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches

1) File and Directory Information Exposure

EUVDB-ID: #VU67740

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20864

CWE-ID: CWE-538 - File And Directory Information Exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to a problem with the file and boot variable permissions in the password-recovery disable feature. An attacker with physical access can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Catalyst 3600 Series Switches: All versions

Catalyst 3800 Series Switches: All versions

Catalyst 9200 Series Switches: All versions

Catalyst 9300 Series Switches: All versions

Catalyst 9400 Series Switches: All versions

Catalyst 9500 Series Switches: All versions

Catalyst 9600 Series Switches: All versions

Cisco IOS XE ROM Monitor: before 17.8.1r

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-info-disc-nrORXjO

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.