CVE-2022-20650 Cisco NX-OS Software NX-API Command Injection Vulnerability

What is CVE-2022-20650?

CVE-2022-20650 is a high-severity command injection vulnerability in Cisco Nx-Os, published on 23 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation of user supplied data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP POST request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system. Note: The NX-API feature is disabled by default.

Weakness: CWE-78

Which versions are affected by CVE-2022-20650?

It affects 1 product.

Products include Cisco Nx-Os.

How do I fix CVE-2022-20650?

No fix has been published for CVE-2022-20650 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-20650 being exploited?

There is no known exploitation of CVE-2022-20650 in the wild and no public exploit code.

Other vulnerabilities in Cisco Nx-Os

• CVE-2024-20399 Cisco NX-OS Command Injection Exploited Medium 6.0
• CVE-2021-1361 Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability Critical 9.8
• CVE-2018-0301 Memory corruption in Cisco NX-OS unknown Critical 9.8
• CVE-2016-1453 Memory corruption in n/a Critical 9.8
• CVE-2016-1341 Hardcoded credentials in n/a Critical 9.8

All Cisco Nx-Os vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hrp-jhgv-872c.