PT-2022-2277 · Cisco · Cisco Ios Xe

X.B · Published 2022-04-13 · Updated 2024-03-06 · CVE-2022-20676

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Tool Command Language (Tcl) interpreter could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This issue is due to insufficient input validation of data passed into the Tcl interpreter. An attacker could exploit this by loading malicious Tcl code on an affected device, potentially allowing the execution of arbitrary commands as root. By default, Tcl shell access requires privilege level 15.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-250

CWE-20

Related Identifiers

BDU:2022-02435

CVE-2022-20676

Affected Products

Cisco Ios Xe

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-20676 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-grbtubU · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-grbtubU · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02435 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20676 · Vendor Advisory
• https://t.me/cvenotify/29012 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022041414 · Note
• https://t.me/cvenotify/73117 · Telegram Post