Vulnerability Name:

CVE-2022-20855 (CCN-237461)

Assigned:2021-11-02
Published:2022-09-28
Updated:2022-10-27
Summary:A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.
CVSS v3 Severity:6.7 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.9 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)
6.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.2 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-78
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2022-20855

Source: XF
Type: UNKNOWN
cisco-cve202220855-priv-esc(237461)

Source: CCN
Type: Cisco Security Advisory cisco-sa-ewc-priv-esc-nderYLtK
Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points Privilege Escalation Vulnerability

Source: CISCO
Type: Vendor Advisory
20220928 Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points Privilege Escalation Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9130_ap:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9120_ap:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9117_ap:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9105:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9800:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9105axi:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9105axw:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9115:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9115_ap:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9115axe:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9115axi:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9117:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9117axi:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9120:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9120axe:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9120axi:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9120axp:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9124axd:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9124axi:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9130:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9130axe:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9124:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9130axi:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:cisco:ios_software:*:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios_xe_software:*:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios_xr_software:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco ios xe 17.6.1
    cisco catalyst 9800-l -
    cisco catalyst 9800-l-c -
    cisco catalyst 9800-l-f -
    cisco catalyst 9800-40 -
    cisco catalyst 9800-80 -
    cisco catalyst 9800-cl -
    cisco catalyst 9130 ap -
    cisco catalyst 9120 ap -
    cisco catalyst 9117 ap -
    cisco catalyst 9105 -
    cisco catalyst 9800 -
    cisco catalyst 9105axi -
    cisco catalyst 9105axw -
    cisco catalyst 9115 -
    cisco catalyst 9115 ap -
    cisco catalyst 9115axe -
    cisco catalyst 9115axi -
    cisco catalyst 9117 -
    cisco catalyst 9117axi -
    cisco catalyst 9120 -
    cisco catalyst 9120axe -
    cisco catalyst 9120axi -
    cisco catalyst 9120axp -
    cisco catalyst 9124axd -
    cisco catalyst 9124axi -
    cisco catalyst 9130 -
    cisco catalyst 9130axe -
    cisco catalyst 9124 -
    cisco catalyst 9130axi -
    cisco ios software *
    cisco ios xe software *
    cisco ios xr software -