Improper Verification of Cryptographic Signature in Catalyst 9200 Series Switches and Cisco IOS XE - CVE-2022-20944
Published: September 29, 2022
Vulnerability identifier: #VU67726
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20944
CWE-ID: CWE-347
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker with physical access can load unsigned software and execute arbitrary code on the target system.
Affected software
Catalyst 9200 Series Switches
Cisco IOS XE
Cisco IOS XE
How to mitigate CVE-2022-20944
Install updates from vendor's website.
Cisco IOS XE - addressed in versions 16.9.8, 16.12.6, 16.12.7, 16.12.8, 17.3.4a, 17.3.4 b, 17.3.5b, 17.3.6, 17.6.1y, 17.6.1a, 17.6.3a, 17.6.4, 17.7.1a, 17.9.1, 17.9.1a