Vulnerability Name:

CVE-2022-20944 (CCN-237454)

Assigned:2021-11-02
Published:2022-09-28
Updated:2022-10-13
Summary:A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to boot a malicious software image or execute unsigned code and bypass the image verification check part of the boot process of the affected device. To exploit this vulnerability, the attacker needs either unauthenticated physical access to the device or privileged access to the root shell on the device.
Note: In Cisco IOS XE Software releases 16.11.1 and later, root shell access is protected by the Consent Token mechanism. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software running on a device to a release where root shell access is more readily available.
CVSS v3 Severity:6.8 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-347
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2022-20944

Source: XF
Type: UNKNOWN
cisco-cve202220944-code-exec(237454)

Source: CCN
Type: Cisco Security Advisory cisco-sa-ios-xe-cat-verify-D4NEQA6q
Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability

Source: CISCO
Type: Vendor Advisory
20220928 Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/o:cisco:ios_xe:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:catalyst_c9200-24p:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200-24t:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200-48p:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200-48t:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-24p-4g:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-24p-4x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-24pxg-2y:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-24pxg-4x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-24t-4g:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9200:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-24t-4x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-48p-4g:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-48p-4x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-48pxg-2y:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-48pxg-4x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-48t-4g:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:catalyst_c9200l-48t-4x:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:cisco:ios_xe_software:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco ios xe -
    cisco catalyst c9200-24p -
    cisco catalyst c9200-24t -
    cisco catalyst c9200-48p -
    cisco catalyst c9200-48t -
    cisco catalyst c9200l-24p-4g -
    cisco catalyst c9200l-24p-4x -
    cisco catalyst c9200l-24pxg-2y -
    cisco catalyst c9200l-24pxg-4x -
    cisco catalyst c9200l-24t-4g -
    cisco catalyst 9200 -
    cisco catalyst 9200cx -
    cisco catalyst 9200l -
    cisco catalyst c9200l-24t-4x -
    cisco catalyst c9200l-48p-4g -
    cisco catalyst c9200l-48p-4x -
    cisco catalyst c9200l-48pxg-2y -
    cisco catalyst c9200l-48pxg-4x -
    cisco catalyst c9200l-48t-4g -
    cisco catalyst c9200l-48t-4x -
    cisco ios xe software *