PT-2022-4255 · Cisco · Cisco Secure Network Analytics

Published 2022-05-18 · Updated 2022-06-09 · CVE-2022-20797

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, (affected versions not specified)

Description The issue is due to insufficient user input validation by the web-based management interface of the affected software. An attacker could exploit this by injecting arbitrary commands in the web-based management interface, potentially allowing them to make configuration changes on the affected device or cause certain services to restart unexpectedly. This could be done by an authenticated, remote attacker to execute arbitrary commands as an administrator on the underlying operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2022-05105

CVE-2022-20797

Affected Products

Cisco Secure Network Analytics

References · 7

• https://osv.dev/vulnerability/CVE-2022-20797 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05105 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-stealth-rce-2hYb9KFK · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20797 · Security Note
• https://t.me/cibsecurity/43490 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022051902 · Note
• https://t.me/cvenotify/30839 · Telegram Post