Cisco IOS XE Self-Healing privileges assignment

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Cisco IOS XE. The affected element is an unknown function of the component Self-Healing. The manipulation leads to privileges assignment. This vulnerability is traded as CVE-2022-20855. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (affected version unknown) and classified as critical. This issue affects an unknown functionality of the component Self-Healing. The manipulation with an unknown input leads to a privileges assignment vulnerability. Using CWE to declare the problem leads to CWE-266. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.

The weakness was shared 10/01/2022 as cisco-sa-ewc-priv-esc-nderYLtK. The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2022-20855 since 11/02/2021. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/29/2022). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion