CVE-2022-20851 : A vulnerability in the web UI feature of Cisco IOS XE Software could allow an au

Products affected by CVE-2022-20851

Cisco » Ios Xe » Version: 17.6.1
cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 1000 Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-6g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100 Integrated Services Router » Version: N/A
When used together with: Cisco » 1101-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1101 Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-2p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109 Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x Integrated Services Router » Version: N/A
When used together with: Cisco » 111x Integrated Services Router » Version: N/A
When used together with: Cisco » 1120 Integrated Services Router » Version: N/A
When used together with: Cisco » 1131 Integrated Services Router » Version: N/A
When used together with: Cisco » 1160 Integrated Services Router » Version: N/A
When used together with: Cisco » 4000 Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4451-x Integrated Services Router » Version: N/A
When used together with: Cisco » 4451 Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » 8101-32fh » Version: N/A
When used together with: Cisco » 8101-32h » Version: N/A
When used together with: Cisco » 8102-64h » Version: N/A
When used together with: Cisco » 8201 » Version: N/A
When used together with: Cisco » 8201-32fh » Version: N/A
When used together with: Cisco » 8202 » Version: N/A
When used together with: Cisco » 8800 12-slot » Version: N/A
When used together with: Cisco » 8800 18-slot » Version: N/A
When used together with: Cisco » 8800 4-slot » Version: N/A
When used together with: Cisco » 8800 8-slot » Version: N/A
When used together with: Cisco » 8804 » Version: N/A
When used together with: Cisco » 8808 » Version: N/A
When used together with: Cisco » 8812 » Version: N/A
When used together with: Cisco » 8818 » Version: N/A
When used together with: Cisco » 8831 » Version: N/A
When used together with: Cisco » Asr 1000-esp100 » Version: N/A
When used together with: Cisco » Asr 1000-x » Version: N/A
When used together with: Cisco » Asr 1001 » Version: N/A
When used together with: Cisco » Asr 1001-hx » Version: N/A
When used together with: Cisco » Asr 1001-hx R » Version: N/A
When used together with: Cisco » Asr 1001-x » Version: N/A
When used together with: Cisco » Asr 1001-x R » Version: N/A
When used together with: Cisco » Asr 1002 » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1002-hx R » Version: N/A
When used together with: Cisco » Asr 1002-x » Version: N/A
When used together with: Cisco » Asr 1002-x R » Version: N/A
When used together with: Cisco » Asr 1002 Fixed Router » Version: N/A
When used together with: Cisco » Asr 1004 » Version: N/A
When used together with: Cisco » Asr 1006 » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Asr 1013 » Version: N/A
When used together with: Cisco » Asr 1023 » Version: N/A
When used together with: Cisco » Catalyst 3650 » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48fd-e » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48fd-l » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48fd-s » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uq » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uq-e » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uq-l » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uq-s » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48ur » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48ur-e » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48ur-l » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48ur-s » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uz » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uz-e » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uz-l » Version: N/A
When used together with: Cisco » Catalyst 3650-12x48uz-s » Version: N/A
When used together with: Cisco » Catalyst 3650-24pd » Version: N/A
When used together with: Cisco » Catalyst 3650-24pd-e » Version: N/A
When used together with: Cisco » Catalyst 3650-24pd-l » Version: N/A
When used together with: Cisco » Catalyst 3650-24pd-s » Version: N/A
When used together with: Cisco » Catalyst 3650-24pdm » Version: N/A
When used together with: Cisco » Catalyst 3650-24pdm-e » Version: N/A
When used together with: Cisco » Catalyst 3650-24pdm-l » Version: N/A
When used together with: Cisco » Catalyst 3650-24pdm-s » Version: N/A
When used together with: Cisco » Catalyst 3650-24ps-e » Version: N/A
When used together with: Cisco » Catalyst 3650-24ps-l » Version: N/A
When used together with: Cisco » Catalyst 3650-24ps-s » Version: N/A
When used together with: Cisco » Catalyst 3650-24td-e » Version: N/A
When used together with: Cisco » Catalyst 3650-24td-l » Version: N/A
When used together with: Cisco » Catalyst 3650-24td-s » Version: N/A
When used together with: Cisco » Catalyst 3650-24ts-e » Version: N/A
When used together with: Cisco » Catalyst 3650-24ts-l » Version: N/A
When used together with: Cisco » Catalyst 3650-24ts-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48fd-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48fd-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48fd-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48fq » Version: N/A
When used together with: Cisco » Catalyst 3650-48fq-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48fq-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48fq-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48fqm » Version: N/A
When used together with: Cisco » Catalyst 3650-48fqm-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48fqm-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48fqm-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48fs-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48fs-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48fs-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48pd-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48pd-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48pd-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48pq-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48pq-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48pq-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48ps-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48ps-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48ps-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48td-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48td-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48td-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48tq-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48tq-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48tq-s » Version: N/A
When used together with: Cisco » Catalyst 3650-48ts-e » Version: N/A
When used together with: Cisco » Catalyst 3650-48ts-l » Version: N/A
When used together with: Cisco » Catalyst 3650-48ts-s » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24pd-e » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24pd-l » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24pd-s » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24uq » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24uq-e » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24uq-l » Version: N/A
When used together with: Cisco » Catalyst 3650-8x24uq-s » Version: N/A
When used together with: Cisco » Catalyst 3850 » Version: N/A
When used together with: Cisco » Catalyst 3850-12s-e » Version: N/A
When used together with: Cisco » Catalyst 3850-12s-s » Version: N/A
When used together with: Cisco » Catalyst 3850-12x48u » Version: N/A
When used together with: Cisco » Catalyst 3850-12xs-e » Version: N/A
When used together with: Cisco » Catalyst 3850-12xs-s » Version: N/A
When used together with: Cisco » Catalyst 3850-16xs-e » Version: N/A
When used together with: Cisco » Catalyst 3850-16xs-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24p-e » Version: N/A
When used together with: Cisco » Catalyst 3850-24p-l » Version: N/A
When used together with: Cisco » Catalyst 3850-24p-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24pw-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24s-e » Version: N/A
When used together with: Cisco » Catalyst 3850-24s-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24t-e » Version: N/A
When used together with: Cisco » Catalyst 3850-24t-l » Version: N/A
When used together with: Cisco » Catalyst 3850-24t-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24u » Version: N/A
When used together with: Cisco » Catalyst 3850-24u-e » Version: N/A
When used together with: Cisco » Catalyst 3850-24u-l » Version: N/A
When used together with: Cisco » Catalyst 3850-24u-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24xs » Version: N/A
When used together with: Cisco » Catalyst 3850-24xs-e » Version: N/A
When used together with: Cisco » Catalyst 3850-24xs-s » Version: N/A
When used together with: Cisco » Catalyst 3850-24xu » Version: N/A
When used together with: Cisco » Catalyst 3850-24xu-e » Version: N/A
When used together with: Cisco » Catalyst 3850-24xu-l » Version: N/A
When used together with: Cisco » Catalyst 3850-24xu-s » Version: N/A
When used together with: Cisco » Catalyst 3850-32xs-e » Version: N/A
When used together with: Cisco » Catalyst 3850-32xs-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48f-e » Version: N/A
When used together with: Cisco » Catalyst 3850-48f-l » Version: N/A
When used together with: Cisco » Catalyst 3850-48f-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48p-e » Version: N/A
When used together with: Cisco » Catalyst 3850-48p-l » Version: N/A
When used together with: Cisco » Catalyst 3850-48p-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48pw-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48t-e » Version: N/A
When used together with: Cisco » Catalyst 3850-48t-l » Version: N/A
When used together with: Cisco » Catalyst 3850-48t-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48u » Version: N/A
When used together with: Cisco » Catalyst 3850-48u-e » Version: N/A
When used together with: Cisco » Catalyst 3850-48u-l » Version: N/A
When used together with: Cisco » Catalyst 3850-48u-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48xs » Version: N/A
When used together with: Cisco » Catalyst 3850-48xs-e » Version: N/A
When used together with: Cisco » Catalyst 3850-48xs-f-e » Version: N/A
When used together with: Cisco » Catalyst 3850-48xs-f-s » Version: N/A
When used together with: Cisco » Catalyst 3850-48xs-s » Version: N/A
When used together with: Cisco » Catalyst 3850-nm-2-40g » Version: N/A
When used together with: Cisco » Catalyst 3850-nm-8-10g » Version: N/A
When used together with: Cisco » Catalyst 8200 » Version: N/A
When used together with: Cisco » Catalyst 8300 » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-6t » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-6t » Version: N/A
When used together with: Cisco » Catalyst 8500 » Version: N/A
When used together with: Cisco » Catalyst 8500-4qc » Version: N/A
When used together with: Cisco » Catalyst 8500l » Version: N/A
When used together with: Cisco » Catalyst 8510csr » Version: N/A
When used together with: Cisco » Catalyst 8510msr » Version: N/A
When used together with: Cisco » Catalyst 8540csr » Version: N/A
When used together with: Cisco » Catalyst 8540msr » Version: N/A
When used together with: Cisco » Catalyst 9200 » Version: N/A
When used together with: Cisco » Catalyst 9200cx » Version: N/A
When used together with: Cisco » Catalyst 9200l » Version: N/A
When used together with: Cisco » Catalyst 9300 » Version: N/A

Max 200 conditions are displayed on this page, to prevent potential performance issues, please refer to NVD for more details.

Exploit prediction scoring system (EPSS) score for CVE-2022-20851

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-20851

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N	1.2	4.2	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: High Availability: None
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-20851

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: ykramarz@cisco.com (Secondary)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-20851

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-Gje47EMn

Cisco IOS XE Software Web UI Command Injection Vulnerability
Vendor Advisory

Vulnerability Details : CVE-2022-20851

Products affected by CVE-2022-20851

Exploit prediction scoring system (EPSS) score for CVE-2022-20851

CVSS scores for CVE-2022-20851

CWE ids for CVE-2022-20851

References for CVE-2022-20851