{"id":"CVE-2022-20655","state":"PUBLISHED","title":"A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack.\r","description":"A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack.\r\n The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root.","publishedAt":"2024-11-15T15:56:42.927Z","updatedAt":"2024-11-15T21:00:58.460Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco IOS XR Software","Cisco Cisco Virtual Topology System (VTS)","Cisco Cisco Network Services Orchestrator","Cisco Cisco Enterprise NFV Infrastructure Software","Cisco Cisco Catalyst SD-WAN","Cisco Cisco Catalyst SD-WAN Manager","Cisco Cisco IOS XE Catalyst SD-WAN","Cisco Cisco SD-WAN vEdge Router","Cisco Cisco Ultra Gateway Platform","Cisco Cisco Carrier Packet Transport"],"affected":[{"vendor":"Cisco","product":"Cisco IOS XR Software","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Virtual Topology System (VTS)","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Network Services Orchestrator","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Enterprise NFV Infrastructure Software","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Catalyst SD-WAN","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Catalyst SD-WAN Manager","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco IOS XE Catalyst SD-WAN","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco SD-WAN vEdge Router","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Ultra Gateway Platform","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Carrier Packet Transport","versions":[{"version":"3.5","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"2.5","status":"affected"},{"version":"2.0","status":"affected"},{"version":"9.2.2","status":"affected"},{"version":"1.4.0","status":"affected"},{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"},{"version":"2.1.0","status":"affected"},{"version":"2.3.0","status":"affected"},{"version":"2.3.3","status":"affected"},{"version":"2.3.5","status":"affected"},{"version":"2.3.4","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.0","status":"affected"},{"version":"2.0.3","status":"affected"},{"version":"2.0.4","status":"affected"},{"version":"2.0.5","status":"affected"},{"version":"2.4.0","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"10.8.0","status":"affected"},{"version":"7.0.3","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.1.1","status":"affected"},{"version":"1.1.2","status":"affected"},{"version":"4.1","status":"affected"},{"version":"4.0","status":"affected"},{"version":"12.1.0","status":"affected"},{"version":"9.8.1","status":"affected"},{"version":"9.8.0","status":"affected"},{"version":"4.1.82","status":"affected"},{"version":"4.1.4","status":"affected"},{"version":"4.6.1","status":"affected"},{"version":"4.0.4","status":"affected"},{"version":"4.0.3","status":"affected"},{"version":"6.2.4","status":"affected"},{"version":"3.0.5","status":"affected"},{"version":"3.0.6","status":"affected"},{"version":"3.0.7","status":"affected"},{"version":"3.0.3","status":"affected"},{"version":"3.0.0","status":"affected"},{"version":"9.5.0","status":"affected"},{"version":"9.5.3","status":"affected"},{"version":"9.5.1","status":"affected"},{"version":"9.5.2","status":"affected"},{"version":"9.7.0","status":"affected"},{"version":"9.521","status":"affected"},{"version":"4.5.0","status":"affected"},{"version":"4.7.0","status":"affected"},{"version":"3.2.0","status":"affected"},{"version":"3.2.1","status":"affected"},{"version":"3.1.0","status":"affected"}]}],"references":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confdcli-cmdinj-wybQDSSh"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:49:32.184Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/20xxx/CVE-2022-20655.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-20655","state":"PUBLISHED","datePublished":"2024-11-15T15:56:42.927Z","dateUpdated":"2024-11-15T21:00:58.460Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2021-11-02T13:28:29.037Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack.\r\n The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root."}],"affected":[{"vendor":"Cisco","product":"Cisco IOS XR Software","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Virtual Topology System (VTS)","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Network Services Orchestrator","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Enterprise NFV Infrastructure Software","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Catalyst SD-WAN","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Catalyst SD-WAN Manager","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco IOS XE Catalyst SD-WAN","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco SD-WAN vEdge Router","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Ultra Gateway Platform","versions":[{"version":"N/A","status":"affected"}]},{"vendor":"Cisco","product":"Cisco Carrier Packet Transport","versions":[{"version":"3.5","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"2.5","status":"affected"},{"version":"2.0","status":"affected"},{"version":"9.2.2","status":"affected"},{"version":"1.4.0","status":"affected"},{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"},{"version":"2.1.0","status":"affected"},{"version":"2.3.0","status":"affected"},{"version":"2.3.3","status":"affected"},{"version":"2.3.5","status":"affected"},{"version":"2.3.4","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.0","status":"affected"},{"version":"2.0.3","status":"affected"},{"version":"2.0.4","status":"affected"},{"version":"2.0.5","status":"affected"},{"version":"2.4.0","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"10.8.0","status":"affected"},{"version":"7.0.3","status":"affected"},{"version":"7.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.1.1","status":"affected"},{"version":"1.1.2","status":"affected"},{"version":"4.1","status":"affected"},{"version":"4.0","status":"affected"},{"version":"12.1.0","status":"affected"},{"version":"9.8.1","status":"affected"},{"version":"9.8.0","status":"affected"},{"version":"4.1.82","status":"affected"},{"version":"4.1.4","status":"affected"},{"version":"4.6.1","status":"affected"},{"version":"4.0.4","status":"affected"},{"version":"4.0.3","status":"affected"},{"version":"6.2.4","status":"affected"},{"version":"3.0.5","status":"affected"},{"version":"3.0.6","status":"affected"},{"version":"3.0.7","status":"affected"},{"version":"3.0.3","status":"affected"},{"version":"3.0.0","status":"affected"},{"version":"9.5.0","status":"affected"},{"version":"9.5.3","status":"affected"},{"version":"9.5.1","status":"affected"},{"version":"9.5.2","status":"affected"},{"version":"9.7.0","status":"affected"},{"version":"9.521","status":"affected"},{"version":"4.5.0","status":"affected"},{"version":"4.7.0","status":"affected"},{"version":"3.2.0","status":"affected"},{"version":"3.2.1","status":"affected"},{"version":"3.1.0","status":"affected"}]}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB","name":"cisco-sa-cli-cmdinj-4MttWZPB"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confdcli-cmdinj-wybQDSSh","name":"cisco-sa-confdcli-cmdinj-wybQDSSh"}],"metrics":[{"format":"cvssV3_1","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"cwe"}]}],"providerMetadata":{"shortName":"cisco","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateUpdated":"2024-11-15T15:56:42.927Z"},"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-cli-cmdinj-4MttWZPB","discovery":"INTERNAL","defects":["CSCvq22323","CSCvq58164","CSCvq58224","CSCvq58168","CSCvq58183","CSCvq58226","CSCvz49669","CSCvq58204","CSCvm76596"]}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"cisco","product":"ios_xr_software","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"7.0.2","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.1","versionType":"custom"}],"cpes":["cpe:2.3:o:cisco:ios_xr_software:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"virtual_topology_system","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.6.5","versionType":"custom"}],"cpes":["cpe:2.3:a:cisco:virtual_topology_system:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"network_services_orchestrator","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.3.9.1","versionType":"custom"},{"version":"4.4.0.0","status":"affected","lessThan":"4.4.5.6","versionType":"custom"},{"version":"4.5.0","status":"affected","lessThan":"4.5.7","versionType":"custom"},{"version":"4.6.0","status":"affected","lessThan":"4.6.1.7","versionType":"custom"},{"version":"4.7.0","status":"affected","lessThan":"4.7.1","versionType":"custom"},{"version":"5.1.0","status":"affected","lessThan":"5.1.0.1","versionType":"custom"}],"cpes":["cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"enterprise_nfv_infrastructure_software","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.12.1","versionType":"custom"}],"cpes":["cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"catalyst_sd-wan_manager","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"18.4.4","versionType":"custom"},{"version":"19.2.0","status":"affected","lessThan":"19.2.1","versionType":"custom"}],"cpes":["cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"ios_xe_catalyst_sd-wan","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"16.10.2","versionType":"custom"},{"version":"16.12.0","status":"affected","lessThan":"16.12.1b","versionType":"custom"},{"version":"17.2.0","status":"affected","lessThan":"17.2.1r","versionType":"custom"}],"cpes":["cpe:2.3:o:cisco:ios_xe_catalyst_sd-wan:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"sd-wan_vedge_router","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"18.4.4","versionType":"custom"},{"version":"19.2.0","status":"affected","lessThan":"19.2.1","versionType":"custom"}],"cpes":["cpe:2.3:a:cisco:sd-wan_vedge_router:*:*:*:*:*:*:*:*"]},{"vendor":"cisco","product":"carrier_packet_transport","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}],"cpes":["cpe:2.3:a:cisco:carrier_packet_transport:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-15T19:43:18.170598Z","id":"CVE-2022-20655","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-15T21:00:58.460Z"}}]}}}