CVE-2022-20871 is a high-severity command injection vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance. It allows an authenticated, remote attacker with at least read-only credentials to execute arbitrary commands and elevate privileges to root due to insufficient input validation. The vulnerability has a CVSS score of 8.8 (High) and could lead to full compromise of the underlying operating system. While Cisco has released software updates, there are no known workarounds. There is no evidence of active exploitation, nor are there public exploit modules available in Metasploit, Nuclei, or ExploitDB, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.5.1-011CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:12.5.1-011:*:*:*:*:*:*:* | ||
12.5.2-007CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:12.5.2-007:*:*:*:*:*:*:* | ||
12.5.2-011CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:12.5.2-011:*:*:*:*:*:*:* | ||
12.5.3-002CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:12.5.3-002:*:*:*:*:*:*:* | ||
12.5.4-005CPE matchmatch criteria | cpe:2.3:o:cisco:asyncos:12.5.4-005:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.