PT-2022-1433 · Cisco · Cisco Ece

Published 2022-01-12 · Updated 2025-08-11 · CVE-2022-20634

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco ECE (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this by persuading a user to click a crafted link, allowing the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of issue is known as an open redirect and is used in phishing attacks.

Recommendations For all affected versions, update to the latest software version released by Cisco, as it addresses this issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface until the issue is resolved with a software update.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2022-00536

CVE-2022-20634

Affected Products

Cisco Ece

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-20634 · Security Note
• https://bdu.fstec.ru/vul/2022-00536 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-multivulns-kbK2yVhR · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20634 · Vendor Advisory
• https://twitter.com/CVEnew/status/1857458718167703796 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-multivulns-kbK2yVhR · Note
• https://t.me/cveNotify/131699 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022012507 · Note