CVE-2022-20855
Estado: ModificadaMedia (6.7)—
A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 6.7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.36%
- Percentil entre todas las CVEs puntuadas: 28
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-266
- CWE-78
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-20855",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-20855",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-11-01T18:42:17.297328Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 7.9,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.8,
"exploitabilityScore": 1.5
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.7,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 0.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco IOS XE Software",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2022-09-30T19:15:12.963",
"references": [
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewc-priv-esc-nderYLtK",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewc-priv-esc-nderYLtK",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-266"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la funcionalidad de autocuración del software Cisco IOS XE para controladores inalámbricos integrados en puntos de acceso Catalyst podría permitir a un atacante local autenticado escapar del shell restringido del controlador y ejecutar comandos arbitrarios en el sistema operativo subyacente del punto de acceso. Esta vulnerabilidad es debido a comprobaciones inapropiadas durante el reinicio de determinados procesos del sistema. Un atacante podría explotar esta vulnerabilidad al entrar en un dispositivo afectado y ejecutando determinados comandos CLI. Una explotación con éxito podría permitir al atacante ejecutar comandos arbitrarios en el Sistema Operativo subyacente como root. Para explotar con éxito esta vulnerabilidad, un atacante necesitaría credenciales válidas para un usuario de nivel de privilegio 15 del controlador inalámbrico"
}
],
"lastModified": "2026-06-17T04:25:15.967",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DE62C4B-7C06-4907-BADE-416C1618D2D9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:catalyst_9105:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5F3CCCFE-88CC-4F7B-8958-79CA62516EA9"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9105axi:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19F93DF4-67DB-4B30-AC22-60C67DF32DB2"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9105axw:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "59C77B06-3C22-4092-AAAB-DB099A0B16A6"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9115:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4081C532-3B10-4FBF-BB22-5BA17BC6FCF8"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9115_ap:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "56A3430C-9AF7-4604-AD95-FCF2989E9EB0"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9115axe:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DE4C56A6-E843-498A-A17B-D3D1B01E70E7"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9115axi:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F050F416-44C3-474C-9002-321A33F288D6"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9117:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6FCE2220-E2E6-4A17-9F0A-2C927FAB4AA5"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9117_ap:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C4AE36E2-E7E9-4E49-8BFF-615DACFC65C1"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9117axi:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7A699C5C-CD03-4263-952F-5074B470F20E"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A47C2D6F-8F90-4D74-AFE1-EAE954021F46"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9120_ap:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C04889F8-3C2A-41AA-9DC9-5A4A4BBE60E7"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9120axe:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "46D41CFE-784B-40EE-9431-8097428E5892"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9120axi:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5D148A27-85B6-4883-96B5-343C8D32F23B"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9120axp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "735CA950-672C-4787-8910-48AD07868FDE"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9124:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C11EF240-7599-4138-B7A7-17E4479F5B83"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9124axd:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E987C945-4D6D-4BE5-B6F0-784B7E821D11"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9124axi:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B434C6D7-F583-4D2B-9275-38A5EC4ECC30"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E1C8E35A-5A9B-4D56-A753-937D5CFB5B19"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9130_ap:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "248A3FFC-C33C-4336-A37C-67B6046556E5"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9130axe:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4EC1F736-6240-4FA2-9FEC-D8798C9D287C"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9130axi:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "169E5354-07EA-4639-AB4B-20D2B9DE784C"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A48E6CF0-7A3B-4D11-8D02-0CD38F2420E9"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1B9ED0E5-CB20-4106-9CF2-8EB587B33543"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2B0E620C-8E09-4F7C-A326-26013173B993"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FF93F1C8-669F-4ECB-8D81-ECDA7B550175"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2E0BA345-B7D7-4975-9199-4DC7875BBFD0"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4E9EA95F-4E39-4D9C-8A84-D1F6014A4A40"
},
{
"criteria": "cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EA0BC769-C244-41BD-BE80-E67F4E1CDDA4"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}