CVE-2022-20871 Cisco Secure Web Appliance Privilege Escalation Vulnerability
Authenticated attackers can inject commands via the web interface to execute arbitrary code and gain root privileges on Cisco Secure Web Appliance.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-20871?
CVE-2022-20871 is a medium-severity command injection vulnerability in Cisco Asyncos, published on 15 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .
Weakness: CWE-78
Which versions are affected by CVE-2022-20871?
It affects 1 product.
Products include Cisco Asyncos.
How do I fix CVE-2022-20871?
No fix has been published for CVE-2022-20871 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-20871 being exploited?
There is no known exploitation of CVE-2022-20871 in the wild and no public exploit code.
Other vulnerabilities in Cisco Asyncos
- CVE-2025-20393 Cisco Multiple Products Improper Input Validation
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal
- CVE-2026-76461 Cisco Secure Email Gateway SQL Injection
- CVE-2024-20435 Command injection in Cisco Secure Web Appliance
- CVE-2019-15956 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability
Sources
Also known as GHSA-rw66-6rgj-mwjh.