PT-2022-2309 · Confd+1 · Confd+1

Published 2022-01-19 · Updated 2024-11-18 · CVE-2022-20655

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConfD (affected versions not specified)

Description A vulnerability in the implementation of the CLI on a device running ConfD could allow an authenticated, local attacker to perform a command injection attack. The issue is due to insufficient validation of a process argument on an affected device. An attacker could exploit this by injecting commands during the execution of this process, potentially allowing the execution of arbitrary commands on the underlying operating system with the privilege level of ConfD, commonly root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-02495

CVE-2022-20655

Affected Products

Cisco Ios Xr

Confd

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-20655 · Security Note
• https://bdu.fstec.ru/vul/2022-02495 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confdcli-cmdinj-wybQDSSh · Vendor Advisory
• https://t.me/true_secator/2544 · Telegram Post
• https://twitter.com/CVEnew/status/1857458724727632018 · Twitter Post
• https://twitter.com/CveFindCom/status/1857461739283009896 · Twitter Post
• https://t.me/my_cyde/264 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB · Note