PT-2022-1431 · Cisco · Cisco Ece

Published 2022-01-12 · Updated 2024-11-18 · CVE-2022-20633

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco ECE (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device. This is due to differences in authentication responses sent back from the application as part of an authentication attempt. An attacker could exploit this by sending authentication requests to an affected device, potentially confirming existing user accounts for use in further attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-204

Related Identifiers

BDU:2022-00534

CVE-2022-20633

Affected Products

Cisco Ece

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-20633 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-multivulns-kbK2yVhR · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20633 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00534 · Security Note
• https://twitter.com/transilienceai/status/1857654880283885842 · Twitter Post
• https://twitter.com/CVEnew/status/1857476948970107336 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-multivulns-kbK2yVhR · Note
• https://twitter.com/transilienceai/status/1857654873476522416 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2022012507 · Note