A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot variable permissions in ROMMON. An attacker could exploit this vulnerability by rebooting the switch into ROMMON and entering specific commands through the console. A successful exploit could allow the attacker to read any file or reset the enable password.

Project Subscriptions

Vendors Products
Catalyst 3650 Subscribe
Catalyst 3650-12x48fd-e Subscribe
Catalyst 3650-12x48fd-l Subscribe
Catalyst 3650-12x48fd-s Subscribe
Catalyst 3650-12x48uq Subscribe
Catalyst 3650-12x48uq-e Subscribe
Catalyst 3650-12x48uq-l Subscribe
Catalyst 3650-12x48uq-s Subscribe
Catalyst 3650-12x48ur Subscribe
Catalyst 3650-12x48ur-e Subscribe
Catalyst 3650-12x48ur-l Subscribe
Catalyst 3650-12x48ur-s Subscribe
Catalyst 3650-12x48uz Subscribe
Catalyst 3650-12x48uz-e Subscribe
Catalyst 3650-12x48uz-l Subscribe
Catalyst 3650-12x48uz-s Subscribe
Catalyst 3650-24pd Subscribe
Catalyst 3650-24pd-e Subscribe
Catalyst 3650-24pd-l Subscribe
Catalyst 3650-24pd-s Subscribe
Catalyst 3650-24pdm Subscribe
Catalyst 3650-24pdm-e Subscribe
Catalyst 3650-24pdm-l Subscribe
Catalyst 3650-24pdm-s Subscribe
Catalyst 3650-24ps-e Subscribe
Catalyst 3650-24ps-l Subscribe
Catalyst 3650-24ps-s Subscribe
Catalyst 3650-24td-e Subscribe
Catalyst 3650-24td-l Subscribe
Catalyst 3650-24td-s Subscribe
Catalyst 3650-24ts-e Subscribe
Catalyst 3650-24ts-l Subscribe
Catalyst 3650-24ts-s Subscribe
Catalyst 3650-48fd-e Subscribe
Catalyst 3650-48fd-l Subscribe
Catalyst 3650-48fd-s Subscribe
Catalyst 3650-48fq Subscribe
Catalyst 3650-48fq-e Subscribe
Catalyst 3650-48fq-l Subscribe
Catalyst 3650-48fq-s Subscribe
Catalyst 3650-48fqm Subscribe
Catalyst 3650-48fqm-e Subscribe
Catalyst 3650-48fqm-l Subscribe
Catalyst 3650-48fqm-s Subscribe
Catalyst 3650-48fs-e Subscribe
Catalyst 3650-48fs-l Subscribe
Catalyst 3650-48fs-s Subscribe
Catalyst 3650-48pd-e Subscribe
Catalyst 3650-48pd-l Subscribe
Catalyst 3650-48pd-s Subscribe
Catalyst 3650-48pq-e Subscribe
Catalyst 3650-48pq-l Subscribe
Catalyst 3650-48pq-s Subscribe
Catalyst 3650-48ps-e Subscribe
Catalyst 3650-48ps-l Subscribe
Catalyst 3650-48ps-s Subscribe
Catalyst 3650-48td-e Subscribe
Catalyst 3650-48td-l Subscribe
Catalyst 3650-48td-s Subscribe
Catalyst 3650-48tq-e Subscribe
Catalyst 3650-48tq-l Subscribe
Catalyst 3650-48tq-s Subscribe
Catalyst 3650-48ts-e Subscribe
Catalyst 3650-48ts-l Subscribe
Catalyst 3650-48ts-s Subscribe
Catalyst 3650-8x24pd-e Subscribe
Catalyst 3650-8x24pd-l Subscribe
Catalyst 3650-8x24pd-s Subscribe
Catalyst 3650-8x24uq Subscribe
Catalyst 3650-8x24uq-e Subscribe
Catalyst 3650-8x24uq-l Subscribe
Catalyst 3650-8x24uq-s Subscribe
Catalyst 3850 Subscribe
Catalyst 3850-12s-e Subscribe
Catalyst 3850-12s-s Subscribe
Catalyst 3850-12x48u Subscribe
Catalyst 3850-12xs-e Subscribe
Catalyst 3850-12xs-s Subscribe
Catalyst 3850-16xs-e Subscribe
Catalyst 3850-16xs-s Subscribe
Catalyst 3850-24p-e Subscribe
Catalyst 3850-24p-l Subscribe
Catalyst 3850-24p-s Subscribe
Catalyst 3850-24pw-s Subscribe
Catalyst 3850-24s-e Subscribe
Catalyst 3850-24s-s Subscribe
Catalyst 3850-24t-e Subscribe
Catalyst 3850-24t-l Subscribe
Catalyst 3850-24t-s Subscribe
Catalyst 3850-24u Subscribe
Catalyst 3850-24u-e Subscribe
Catalyst 3850-24u-l Subscribe
Catalyst 3850-24u-s Subscribe
Catalyst 3850-24xs Subscribe
Catalyst 3850-24xs-e Subscribe
Catalyst 3850-24xs-s Subscribe
Catalyst 3850-24xu Subscribe
Catalyst 3850-24xu-e Subscribe
Catalyst 3850-24xu-l Subscribe
Catalyst 3850-24xu-s Subscribe
Catalyst 3850-32xs-e Subscribe
Catalyst 3850-32xs-s Subscribe
Catalyst 3850-48f-e Subscribe
Catalyst 3850-48f-l Subscribe
Catalyst 3850-48f-s Subscribe
Catalyst 3850-48p-e Subscribe
Catalyst 3850-48p-l Subscribe
Catalyst 3850-48p-s Subscribe
Catalyst 3850-48pw-s Subscribe
Catalyst 3850-48t-e Subscribe
Catalyst 3850-48t-l Subscribe
Catalyst 3850-48t-s Subscribe
Catalyst 3850-48u Subscribe
Catalyst 3850-48u-e Subscribe
Catalyst 3850-48u-l Subscribe
Catalyst 3850-48u-s Subscribe
Catalyst 3850-48xs Subscribe
Catalyst 3850-48xs-e Subscribe
Catalyst 3850-48xs-f-e Subscribe
Catalyst 3850-48xs-f-s Subscribe
Catalyst 3850-48xs-s Subscribe
Catalyst 3850-nm-2-40g Subscribe
Catalyst 3850-nm-8-10g Subscribe
Catalyst 9200 Subscribe
Catalyst 9200cx Subscribe
Catalyst 9200l Subscribe
Catalyst 9300 Subscribe
Catalyst 9300-24p-a Subscribe
Catalyst 9300-24p-e Subscribe
Catalyst 9300-24s-a Subscribe
Catalyst 9300-24s-e Subscribe
Catalyst 9300-24t-a Subscribe
Catalyst 9300-24t-e Subscribe
Catalyst 9300-24u-a Subscribe
Catalyst 9300-24u-e Subscribe
Catalyst 9300-24ux-a Subscribe
Catalyst 9300-24ux-e Subscribe
Catalyst 9300-48p-a Subscribe
Catalyst 9300-48p-e Subscribe
Catalyst 9300-48s-a Subscribe
Catalyst 9300-48s-e Subscribe
Catalyst 9300-48t-a Subscribe
Catalyst 9300-48t-e Subscribe
Catalyst 9300-48u-a Subscribe
Catalyst 9300-48u-e Subscribe
Catalyst 9300-48un-a Subscribe
Catalyst 9300-48un-e Subscribe
Catalyst 9300-48uxm-a Subscribe
Catalyst 9300-48uxm-e Subscribe
Catalyst 9300l Subscribe
Catalyst 9300l-24p-4g-a Subscribe
Catalyst 9300l-24p-4g-e Subscribe
Catalyst 9300l-24p-4x-a Subscribe
Catalyst 9300l-24p-4x-e Subscribe
Catalyst 9300l-24t-4g-a Subscribe
Catalyst 9300l-24t-4g-e Subscribe
Catalyst 9300l-24t-4x-a Subscribe
Catalyst 9300l-24t-4x-e Subscribe
Catalyst 9300l-48p-4g-a Subscribe
Catalyst 9300l-48p-4g-e Subscribe
Catalyst 9300l-48p-4x-a Subscribe
Catalyst 9300l-48p-4x-e Subscribe
Catalyst 9300l-48t-4g-a Subscribe
Catalyst 9300l-48t-4g-e Subscribe
Catalyst 9300l-48t-4x-a Subscribe
Catalyst 9300l-48t-4x-e Subscribe
Catalyst 9300l Stack Subscribe
Catalyst 9300lm Subscribe
Catalyst 9300x Subscribe
Catalyst 9400 Subscribe
Catalyst 9407r Subscribe
Catalyst 9410r Subscribe
Catalyst 9500 Subscribe
Catalyst 9500h Subscribe
Catalyst 9600 Subscribe
Catalyst 9600x Subscribe
Catalyst C2928-24lt-c Subscribe
Catalyst C2928-48tc-c Subscribe
Catalyst C3850-12x48u-e Subscribe
Catalyst C3850-12x48u-l Subscribe
Catalyst C3850-12x48u-s Subscribe
Catalyst C9200-24p Subscribe
Catalyst C9200-24t Subscribe
Catalyst C9200-48p Subscribe
Catalyst C9200-48t Subscribe
Catalyst C9200l-24p-4g Subscribe
Catalyst C9200l-24p-4x Subscribe
Catalyst C9200l-24pxg-2y Subscribe
Catalyst C9200l-24pxg-4x Subscribe
Catalyst C9200l-24t-4g Subscribe
Catalyst C9200l-24t-4x Subscribe
Catalyst C9200l-48p-4g Subscribe
Catalyst C9200l-48p-4x Subscribe
Catalyst C9200l-48pxg-2y Subscribe
Catalyst C9200l-48pxg-4x Subscribe
Catalyst C9200l-48t-4g Subscribe
Catalyst C9200l-48t-4x Subscribe
Catalyst C9300-24p Subscribe
Catalyst C9300-24s Subscribe
Catalyst C9300-24t Subscribe
Catalyst C9300-24u Subscribe
Catalyst C9300-24ux Subscribe
Catalyst C9300-48p Subscribe
Catalyst C9300-48s Subscribe
Catalyst C9300-48t Subscribe
Catalyst C9300-48u Subscribe
Catalyst C9300-48un Subscribe
Catalyst C9300-48uxm Subscribe
Catalyst C9300l-24p-4g Subscribe
Catalyst C9300l-24p-4x Subscribe
Catalyst C9300l-24t-4g Subscribe
Catalyst C9300l-24t-4x Subscribe
Catalyst C9300l-48p-4g Subscribe
Catalyst C9300l-48p-4x Subscribe
Catalyst C9300l-48t-4g Subscribe
Catalyst C9300l-48t-4x Subscribe
Catalyst C9404r Subscribe
Catalyst C9407r Subscribe
Catalyst C9410r Subscribe
Catalyst C9500-12q Subscribe
Catalyst C9500-12q-a Subscribe
Catalyst C9500-12q-e Subscribe
Catalyst C9500-16x Subscribe
Catalyst C9500-16x-a Subscribe
Catalyst C9500-16x-e Subscribe
Catalyst C9500-24q Subscribe
Catalyst C9500-24q-a Subscribe
Catalyst C9500-24q-e Subscribe
Catalyst C9500-24y4c Subscribe
Catalyst C9500-32c Subscribe
Catalyst C9500-32qc Subscribe
Catalyst C9500-40x Subscribe
Catalyst C9500-40x-a Subscribe
Catalyst C9500-40x-e Subscribe
Catalyst C9500-48y4c Subscribe
Catalyst C9600-lc-24c Subscribe
Catalyst C9600-lc-48s Subscribe
Catalyst C9600-lc-48tx Subscribe
Catalyst C9600-lc-48yl Subscribe
Ios Xe Rom Monitor Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2022-26114 A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot variable permissions in ROMMON. An attacker could exploit this vulnerability by rebooting the switch into ROMMON and entering specific commands through the console. A successful exploit could allow the attacker to read any file or reset the enable password.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Fri, 01 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-11-01T18:49:04.147Z

Reserved: 2021-11-02T00:00:00

Link: CVE-2022-20864

cve-icon Vulnrichment

Updated: 2024-08-03T02:24:50.242Z

cve-icon NVD

Status : Modified

Published: 2022-10-10T21:15:10.207

Modified: 2024-11-21T06:43:42.610

Link: CVE-2022-20864

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses