PT-2022-1436 · Cisco · Cisco Tetration

Published 2022-01-12 · Updated 2024-11-18 · CVE-2022-20652

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Tetration (affected versions not specified)

Description The issue is related to insufficient input validation in the web-based management interface and API subsystem, allowing an authenticated, remote attacker to inject arbitrary commands with root-level privileges on the underlying operating system. This can be achieved by submitting a crafted HTTP message to the affected system. The attacker needs valid administrator-level credentials to exploit this issue.

Recommendations To resolve the issue, apply the software updates released by Cisco that address this vulnerability. At the moment, there is no information about additional mitigation measures or workarounds that address this vulnerability.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-00539

CVE-2022-20652

Affected Products

Cisco Tetration

References · 7

• https://bdu.fstec.ru/vul/2022-00539 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tetr-cmd-injc-skrwGO · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-FmbPu2pe · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20652 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tetr-cmd-injc-skrwGO · Note
• https://twitter.com/CVEnew/status/1857458723569938913 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2022012411 · Note