CVE-2022-20964Identity Services Engine OS Command Injection
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system.
Published Nov 29, 2022 · Updated Nov 21, 2024
Key Facts
Patch immediately- CVE-2022-20964 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Identity Services Engine (Cisco), Cisco Identity Services Engine Software.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 31% probability of exploitation in the next 30 days.
- Fixed versions are available, including Identity Services Engine 2.6.0.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
31%
Higher than 98.2% of all scored CVEs
Exploit maturity
None known
ATLAS score
39/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
None known
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the web-based management interface. An attacker could exploit this vulnerability by manipulating requests to the web-based management interface to contain operating system commands.
A successful exploit could allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user. Cisco has not yet released software updates that address this vulnerability.
Affected Products
34 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Identity Services EngineCisco | 2.6.0, 2.6.0-patch1, 2.6.0-patch10, 2.6.0-patch11, 2.6.0-patch12, 2.6.0-patch2, 2.6.0-patch3, 2.6.0-patch5 | 2.6.0 |
| Cisco Identity Services Engine Software | >= 2.6.0 | n/a |
Patched Releases
Identity Services Engine
2.6.0
Timeline
Publicly disclosed
Nov 29, 2022
Last updated
Nov 21, 2024
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
FAQ
Common Questions.
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system.
Affected: Identity Services Engine (Cisco) versions 2.6.0, 2.6.0-patch1, 2.6.0-patch10, 2.6.0-patch11, 2.6.0-patch12, 2.6.0-patch2, 2.6.0-patch3, 2.6.0-patch5; Cisco Identity Services Engine Software versions >= 2.6.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Identity Services Engine 2.6.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2022-20964 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo