CVE-2022-20964 Command injection in Cisco Identity Services Engine Software

Medium 6.3 Published 18 Jan 2023 Updated 21 Nov 2024

Authenticated attackers can inject arbitrary OS commands via the web interface, leading to code execution with web service privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-20964?

CVE-2022-20964 is a medium-severity command injection vulnerability in Cisco Identity Services Engine, published on 18 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the web-based management interface. An attacker could exploit this vulnerability by manipulating requests to the web-based management interface to contain operating system commands. A successful exploit could allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user. Cisco has not yet released software updates that address this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2022-20964?

It affects 1 product.

Products include Cisco Identity Services Engine.

How do I fix CVE-2022-20964?

No fix has been published for CVE-2022-20964 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-20964 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-20964 exists.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-fvm6-h6r9-qcr2.