Execution with unnecessary privileges in Cisco Systems, Inc products - CVE-2022-20719

Vulnerability identifier: #VU62328

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-20719

CWE-ID: CWE-250

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Cisco Systems, Inc

Affected software:
800 Series Industrial Integrated Services Routers
Industrial Ethernet 4000 Series Switches
800 Series Integrated Services Routers
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Cisco ASR 1000 Series Aggregation Services Routers
Catalyst 9x00 Series Switches
Catalyst IE3400 Rugged Series
Embedded Services 3300 Series Switches
IR510 WPAN Industrial Routers
IC3000 Industrial Compute Gateway
CGR1000 Compute Modules
Cisco IOx
Cisco IOS XE
Cisco IOS

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to incomplete sanitization of parameters that are passed in as part of the IOx package descriptor. A remote administrator can execute arbitrary code on the underlying host operating system.

Install updates from vendor's website.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj