What is CVE-2022-20676?

CVE-2022-20676 is a medium-severity vulnerability in Cisco Ios Xe Software, classified under CWE-250. CVSS score: 5.1/10. Published 2022-04-15.

How severe is CVE-2022-20676?

Medium severity. CVSS v3 base score is 5.1 out of 10.

Improper input validation in Cisco Ios Xe Software

CVE-2022-20676

A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This vulnerability is due to insufficient input validation of data that is passed into the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root. By default, Tcl shell access requires privilege level 15.

EPSS: 0.003 (19.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N.

Affected products

Cisco Ios Xe Software — versions n/a
Cisco Ios_xe — versions 16.12.1z2, 17.2.1, 17.2.1a

Weakness classification (CWE)

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2022-20676?: CVE-2022-20676 is a medium-severity vulnerability in Cisco Ios Xe Software, classified under CWE-250. CVSS score: 5.1/10. Published 2022-04-15.
How severe is CVE-2022-20676?: Medium severity. CVSS v3 base score is 5.1 out of 10.