Race condition in Cisco Systems, Inc products - CVE-2022-20724

Vulnerability identifier: #VU62333

CSH Severity: Medium

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20724

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to a race condition for allocation of the token in the Cisco IOx application hosting environment. A remote attacker can exploit the race, bypass authentication and impersonate another authenticated user session.

800 Series Industrial Integrated Services Routers
Industrial Ethernet 4000 Series Switches
800 Series Integrated Services Routers
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Cisco ASR 1000 Series Aggregation Services Routers
Catalyst 9x00 Series Switches
Catalyst IE3400 Rugged Series
Embedded Services 3300 Series Switches
IR510 WPAN Industrial Routers
IC3000 Industrial Compute Gateway
CGR1000 Compute Modules
Cisco IOx
Cisco IOS
Cisco IOS XE

Install updates from vendor's website.

IC3000 Industrial Compute Gateway - update to 1.4.1
Cisco IOx - update to 1.15.0.1
Cisco IOS - update to 15.9(3)M5
Cisco IOS XE - addressed in versions 16.12(6), 17.3(5), 17.6(2), 17.7(1)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj

• Multiple vulnerabilities in Cisco IOx Application Hosting Environment