What is CVE-2022-20871?

CVE-2022-20871 is a medium-severity vulnerability in Cisco Secure Web Appliance, classified under OS Command Injection. CVSS score: 6.3/10. Published 2024-11-15.

How severe is CVE-2022-20871?

Medium severity. CVSS v3 base score is 6.3 out of 10.

RCE in Cisco Secure Web Appliance

CVE-2022-20871

A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.002 (42.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Cisco Secure Web Appliance — versions 12.5.3-002, 14.1.0-032, 14.1.0-047

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cisco-sa-wsa-prv-esc-8PdRU8t8
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv

Frequently asked questions

What is CVE-2022-20871?: CVE-2022-20871 is a medium-severity vulnerability in Cisco Secure Web Appliance, classified under OS Command Injection. CVSS score: 6.3/10. Published 2024-11-15.
How severe is CVE-2022-20871?: Medium severity. CVSS v3 base score is 6.3 out of 10.