What is CVE-2022-20695?

CVE-2022-20695 is a critical-severity vulnerability in Cisco 3504_wireless_controller, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 10.0/10. Published 2022-04-15.

How severe is CVE-2022-20695?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Auth bypass in Cisco 3504_wireless_controller

CVE-2022-20695

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface…

EPSS: 0.199 (97.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Cisco 3504_wireless_controller
Cisco 5520_wireless_controller
Cisco 8540_wireless_controller
Cisco Aironet_1540
Cisco Aironet_1542d
Cisco Aironet_1542i
Cisco Aironet_1560
Cisco Aironet_1562d
Cisco Aironet_1562e
Cisco Aironet_1562i

Weakness classification (CWE)

CWE-303 — Incorrect Implementation of Authentication Algorithm
CWE-287 — Improper Authentication

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2022-20695?: CVE-2022-20695 is a critical-severity vulnerability in Cisco 3504_wireless_controller, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 10.0/10. Published 2022-04-15.
How severe is CVE-2022-20695?: Critical severity. CVSS v3 base score is 10.0 out of 10.