Improper Neutralization of Special Elements in Output Used by a Downstream Component in Cisco Systems, Inc products - CVE-2022-20693

Vulnerability identifier: #VU62339

CSH Severity: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-20693

CWE-ID: CWE-74

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Cisco IOS XE
Catalyst 3850 Series Switches
Catalyst 9200 Series Switches
Catalyst 9300 Series Switches
Catalyst 9400 Series Switches
Catalyst 9500 Series Switches
Catalyst 9500H Series Switches
Catalyst 9600 Series Switches

Software vendor:
Cisco Systems, Inc

The vulnerability allows a remote user to perform an injection attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web UI feature. A remote administrator can inject commands to the underlying operating system.

Install updates from vendor's website.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webuiapi-inj-Nyrq92Od