PT-2022-4313 · Cisco · Cisco Secure Web Appliance+1

Alvaro Gutierrez · Published 2022-08-17 · Updated 2025-08-11 · CVE-2022-20871

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Secure Web Appliance versions prior to 14.5.0-537 Cisco Secure Web Appliance versions 12.5 and 14.0 (updates pending)

Description A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this by authenticating to the system and sending a crafted HTTP packet to the affected device, potentially allowing the execution of arbitrary commands on the underlying operating system and elevation of privileges to root. The attacker would need at least read-only credentials to successfully exploit this vulnerability.

Recommendations For Cisco Secure Web Appliance version prior to 14.5.0-537, update to version 14.5.0-537 or later. For Cisco Secure Web Appliance versions 12.5 and 14.0, apply the pending updates as soon as they are available. As a temporary workaround, consider restricting access to the web management interface until the update is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-05169

CVE-2022-20871

Affected Products

Cisco Asyncos

Cisco Secure Web Appliance

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20871 · Security Note
• https://bdu.fstec.ru/vul/2022-05169 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20871 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU · Vendor Advisory
• https://t.me/true_secator/3312 · Telegram Post
• https://t.me/cveNotify/131700 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8 · Note