#VU62336 Permissions, Privileges, and Access Controls in Cisco Systems, Inc products - CVE-2022-20727
Vulnerability identifier: #VU62336
Vulnerability risk: Low
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-264
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
800 Series Industrial Integrated Services Routers
Other software /
Other software solutions
Industrial Ethernet 4000 Series Switches
Other software /
Other software solutions
800 Series Integrated Services Routers
Hardware solutions /
Routers & switches, VoIP, GSM, etc
Cisco 1000 Series Integrated Services Routers
Hardware solutions /
Routers & switches, VoIP, GSM, etc
4000 Series Integrated Services Routers
Hardware solutions /
Routers & switches, VoIP, GSM, etc
Cisco ASR 1000 Series Aggregation Services Routers
Hardware solutions /
Routers & switches, VoIP, GSM, etc
Catalyst 9x00 Series Switches
Hardware solutions /
Routers & switches, VoIP, GSM, etc
Catalyst IE3400 Rugged Series
Hardware solutions /
Routers & switches, VoIP, GSM, etc
Embedded Services 3300 Series Switches
Hardware solutions /
Routers & switches, VoIP, GSM, etc
IR510 WPAN Industrial Routers
Hardware solutions /
Routers & switches, VoIP, GSM, etc
IC3000 Industrial Compute Gateway
Hardware solutions /
Routers & switches, VoIP, GSM, etc
CGR1000 Compute Modules
Hardware solutions /
Firmware
Cisco IOx
Hardware solutions /
Firmware
Cisco IOS XE
Operating systems & Components /
Operating system
Cisco IOS
Operating systems & Components /
Operating system
Vendor: Cisco Systems, Inc
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A local administrator can modify application content while a Cisco IOx application is loading and gain elevated privileges on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
800 Series Industrial Integrated Services Routers: All versions
800 Series Integrated Services Routers: All versions
CGR1000 Compute Modules: All versions
Industrial Ethernet 4000 Series Switches: All versions
Cisco 1000 Series Integrated Services Routers: All versions
4000 Series Integrated Services Routers: All versions
Cisco ASR 1000 Series Aggregation Services Routers: All versions
Catalyst 9x00 Series Switches: All versions
Catalyst IE3400 Rugged Series: All versions
Embedded Services 3300 Series Switches: All versions
IR510 WPAN Industrial Routers: All versions
Cisco IOS XE: before 16.12(6), 17.3(5), 17.6(2), 17.7(1), 16.12(6), 16.12(6), 16.12(6), 16.12(6)
Cisco IOS: before 15.9(3)M5, 15.9(3)M5
Cisco IOx: before 1.15.0.1
IC3000 Industrial Compute Gateway: before 1.4.1
External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
