CVE-2022-20871
Status: AnalyzedHigh (8.8)—
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device.
Read full descriptionShow less
A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 8.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.92%
- Percentile among all scored CVEs: 79
- Score date: 9/30/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-78
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8
Raw JSON (NVD)
Show
{
"id": "CVE-2022-20871",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-20871",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-11-15T15:35:06.319558Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Secure Web Appliance",
"versions": [
{
"status": "affected",
"version": "12.5.3-002"
},
{
"status": "affected",
"version": "14.1.0-032"
},
{
"status": "affected",
"version": "14.1.0-047"
},
{
"status": "affected",
"version": "14.1.0-041"
},
{
"status": "affected",
"version": "14.0.2-012"
},
{
"status": "affected",
"version": "12.5.1-011"
},
{
"status": "affected",
"version": "12.5.2-007"
},
{
"status": "affected",
"version": "12.5.2-011"
},
{
"status": "affected",
"version": "14.5.0-498"
},
{
"status": "affected",
"version": "12.5.4-005"
},
{
"status": "affected",
"version": "12.5.4-011"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-11-15T16:15:23.757",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU",
"tags": [
"Not Applicable"
],
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv",
"tags": [
"Not Applicable"
],
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root.\r\nThis vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see ."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de administración web de Cisco AsyncOS para Cisco Secure Web Appliance, anteriormente Cisco Web Security Appliance (WSA), podría permitir que un atacante remoto autenticado realice una inyección de comandos y eleve los privilegios a superusuario. Esta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario para la interfaz web. Un atacante podría explotar esta vulnerabilidad autenticándose en el sistema y enviando un paquete HTTP diseñado al dispositivo afectado. Una explotación exitosa podría permitir al atacante ejecutar comandos arbitrarios en el sistema operativo subyacente y elevar los privilegios a superusuario. Para explotar con éxito esta vulnerabilidad, un atacante necesitaría al menos credenciales de solo lectura. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad. Atención: la simplificación de la cartera de Cisco incluye el cambio de nombre de los productos de seguridad bajo una sola marca: Cisco Secure. Para obtener más información, consulte."
}
],
"lastModified": "2026-06-17T04:25:18.127",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.1-011:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2D22A3C-16D5-4F61-AB44-111F4A4D9F5C"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.2-007:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C79D794-0BA9-4A55-B843-FBF9B7374095"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.2-011:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2536DCE8-4F1D-4056-A021-409B54C86ED9"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.3-002:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D75C030-216E-4019-ABA5-6DB662C6755C"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.4-005:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BBE6E431-7859-4E92-88C5-C85DADC8A5D7"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:12.5.4-011:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2FC0B862-5248-42D1-BB20-F957DD98A585"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.0.2-012:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50BAC418-1CA1-4DB7-8B54-E4754A35F6E8"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.1.0-032:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1C5EDF4-868A-43B9-B5BA-0F62984F7BE5"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.1.0-041:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45B7B8BB-91DA-490B-BA54-27AD44F862A4"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.1.0-047:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16B7F282-1F20-4C84-A13E-C671BAE3F8D0"
},
{
"criteria": "cpe:2.3:o:cisco:asyncos:14.5.0-498:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60A56580-C34C-4E5D-B053-9D02F8DD9681"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s1000v:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "09BCBB0F-88F1-4469-A7D4-DA8BCAF5470A"
},
{
"criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s100v:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2F88A369-E3A2-431A-AB71-CCD4F15E68EB"
},
{
"criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s300v:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FE8ED2A4-8E08-420D-B377-6D1F5AF675DC"
},
{
"criteria": "cpe:2.3:a:cisco:secure_web_appliance_virtual_s600v:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "780EA177-5623-4AFF-9316-D557BE2BD47D"
},
{
"criteria": "cpe:2.3:h:cisco:secure_web_appliance_s196:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FE1F2FAF-C64B-4AEB-8DE4-329C61B8D17F"
},
{
"criteria": "cpe:2.3:h:cisco:secure_web_appliance_s396:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B5596058-16DB-46C0-82AC-D9BFC13F4126"
},
{
"criteria": "cpe:2.3:h:cisco:secure_web_appliance_s696:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "62BEA59D-2AF1-4BDF-ACB3-450BED2E5AAB"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}