CVE-2022-20871

Estado: AnalizadaAlta (8.8)—

A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device.

Leer descripción completaMostrar menos

A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.92%
Percentil entre todas las CVEs puntuadas: 79
Fecha de la puntuación: 1/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Asyncos

CWE

CWE-78

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-20871",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-20871",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-15T15:35:06.319558Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Secure Web Appliance",
          "versions": [
            {
              "status": "affected",
              "version": "12.5.3-002"
            },
            {
              "status": "affected",
              "version": "14.1.0-032"
            },
            {
              "status": "affected",
              "version": "14.1.0-047"
            },
            {
              "status": "affected",
              "version": "14.1.0-041"
            },
            {
              "status": "affected",
              "version": "14.0.2-012"
            },
            {
              "status": "affected",
              "version": "12.5.1-011"
            },
            {
              "status": "affected",
              "version": "12.5.2-007"
            },
            {
              "status": "affected",
              "version": "12.5.2-011"
            },
            {
              "status": "affected",
              "version": "14.5.0-498"
            },
            {
              "status": "affected",
              "version": "12.5.4-005"
            },
            {
              "status": "affected",
              "version": "12.5.4-011"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-15T16:15:23.757",
  "references": [
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web management interface of Cisco&nbsp;AsyncOS for Cisco&nbsp;Secure Web Appliance, formerly Cisco&nbsp;Web Security Appliance (WSA),&nbsp;could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root.\r\nThis vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco&nbsp;portfolio includes the renaming of security products under one brand: Cisco&nbsp;Secure. For more information, see ."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administración web de Cisco&#xa0;AsyncOS para Cisco&#xa0;Secure Web Appliance, anteriormente Cisco&#xa0;Web Security Appliance (WSA),&#xa0;podría permitir que un atacante remoto autenticado realice una inyección de comandos y eleve los privilegios a superusuario. Esta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario para la interfaz web. Un atacante podría explotar esta vulnerabilidad autenticándose en el sistema y enviando un paquete HTTP diseñado al dispositivo afectado. Una explotación exitosa podría permitir al atacante ejecutar comandos arbitrarios en el sistema operativo subyacente y elevar los privilegios a superusuario. Para explotar con éxito esta vulnerabilidad, un atacante necesitaría al menos credenciales de solo lectura. Cisco&#xa0;ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad. Atención: la simplificación de la cartera de Cisco incluye el cambio de nombre de los productos de seguridad bajo una sola marca: Cisco&#xa0;Secure. Para obtener más información, consulte."
    }
  ],
  "lastModified": "2026-06-17T04:25:18.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:12.5.1-011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2D22A3C-16D5-4F61-AB44-111F4A4D9F5C"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:12.5.2-007:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C79D794-0BA9-4A55-B843-FBF9B7374095"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:12.5.2-011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2536DCE8-4F1D-4056-A021-409B54C86ED9"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:12.5.3-002:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D75C030-216E-4019-ABA5-6DB662C6755C"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:12.5.4-005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBE6E431-7859-4E92-88C5-C85DADC8A5D7"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:12.5.4-011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FC0B862-5248-42D1-BB20-F957DD98A585"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:14.0.2-012:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50BAC418-1CA1-4DB7-8B54-E4754A35F6E8"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:14.1.0-032:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1C5EDF4-868A-43B9-B5BA-0F62984F7BE5"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:14.1.0-041:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45B7B8BB-91DA-490B-BA54-27AD44F862A4"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:14.1.0-047:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16B7F282-1F20-4C84-A13E-C671BAE3F8D0"
            },
            {
              "criteria": "cpe:2.3:o:cisco:asyncos:14.5.0-498:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60A56580-C34C-4E5D-B053-9D02F8DD9681"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s1000v:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "09BCBB0F-88F1-4469-A7D4-DA8BCAF5470A"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s100v:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2F88A369-E3A2-431A-AB71-CCD4F15E68EB"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s300v:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FE8ED2A4-8E08-420D-B377-6D1F5AF675DC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s600v:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "780EA177-5623-4AFF-9316-D557BE2BD47D"
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_web_appliance_s196:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FE1F2FAF-C64B-4AEB-8DE4-329C61B8D17F"
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_web_appliance_s396:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B5596058-16DB-46C0-82AC-D9BFC13F4126"
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_web_appliance_s696:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "62BEA59D-2AF1-4BDF-ACB3-450BED2E5AAB"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}