{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-20944", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "datePublished": "2022-10-10T20:43:15.121527Z", "dateUpdated": "2024-11-01T18:49:41.306Z", "dateReserved": "2021-11-02T00:00:00"}, "containers": {"cna": {"title": "Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability", "datePublic": "2022-09-28T00:00:00", "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2022-10-10T00:00:00"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to boot a malicious software image or execute unsigned code and bypass the image verification check part of the boot process of the affected device. To exploit this vulnerability, the attacker needs either unauthenticated physical access to the device or privileged access to the root shell on the device. Note: In Cisco IOS XE Software releases 16.11.1 and later, root shell access is protected by the Consent Token mechanism. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software running on a device to a release where root shell access is more readily available."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"name": "20220928 Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-347", "cweId": "CWE-347"}]}], "source": {"advisory": "cisco-sa-ios-xe-cat-verify-D4NEQA6q", "defect": [["CSCvx12117"]], "discovery": "INTERNAL"}, "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T02:31:58.131Z"}, "title": "CVE Program Container", "references": [{"name": "20220928 Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-01T18:42:15.453028Z", "id": "CVE-2022-20944", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T18:49:41.306Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7D95E8A-8F0B-44E5-B266-09E10BAAEC55", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "FC4A5C56-0D08-4423-AEBD-33EDF172FCF9", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*", "matchCriteriaId": "7670A322-31C2-4A8A-86E9-09D63C52E4C2", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*", "matchCriteriaId": "8D6376BE-3A69-469C-B6A9-2EFB55A3B87F", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200-24p:-:*:*:*:*:*:*:*", "matchCriteriaId": "18736C74-F68F-4D0B-AE2B-4BC1834EF794", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200-24t:-:*:*:*:*:*:*:*", "matchCriteriaId": "D223C2AB-22A4-42B5-8BBB-78E2CBF23B40", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200-48p:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDD3EAA2-8F25-4099-B76F-5ACC3BE34610", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200-48t:-:*:*:*:*:*:*:*", "matchCriteriaId": "AE9BD57F-BDAC-46DD-AF87-8914B29670F2", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-24p-4g:-:*:*:*:*:*:*:*", "matchCriteriaId": "AFCEBFFC-DD60-4CB1-A7F2-9AC09977BA4F", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-24p-4x:-:*:*:*:*:*:*:*", "matchCriteriaId": "B9F7B21F-1DAA-45C7-8C24-D3A19F1C5459", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-24pxg-2y:-:*:*:*:*:*:*:*", "matchCriteriaId": "1C4F9918-E075-4F78-AFD7-0BB7FA97C1F6", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-24pxg-4x:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7E00A0B-A58E-472F-B107-0FE106751F2D", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-24t-4g:-:*:*:*:*:*:*:*", "matchCriteriaId": "BCB45406-5216-4A11-B8D3-C44639DC26B0", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-24t-4x:-:*:*:*:*:*:*:*", "matchCriteriaId": "215D01AE-3767-482A-85C5-3361506F0AC3", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-48p-4g:-:*:*:*:*:*:*:*", "matchCriteriaId": "A06E37A8-166F-4534-9089-D20B1227F4DD", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-48p-4x:-:*:*:*:*:*:*:*", "matchCriteriaId": "B9D6DAE3-BAD0-46D8-B899-45B955F532F7", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-48pxg-2y:-:*:*:*:*:*:*:*", "matchCriteriaId": "327167E8-4B65-4F9D-8760-34CDA03887CA", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-48pxg-4x:-:*:*:*:*:*:*:*", "matchCriteriaId": "A0DA2253-C6A9-4749-B313-6552628A96F3", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-48t-4g:-:*:*:*:*:*:*:*", "matchCriteriaId": "C925086A-94B9-4FE0-9FEB-3242C1217453", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_c9200l-48t-4x:-:*:*:*:*:*:*:*", "matchCriteriaId": "6EB14B34-4035-41D2-834B-7FB069264207", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to boot a malicious software image or execute unsigned code and bypass the image verification check part of the boot process of the affected device. To exploit this vulnerability, the attacker needs either unauthenticated physical access to the device or privileged access to the root shell on the device. Note: In Cisco IOS XE Software releases 16.11.1 and later, root shell access is protected by the Consent Token mechanism. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software running on a device to a release where root shell access is more readily available."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n de verificaci\u00f3n de im\u00e1genes de software del software Cisco IOS XE para los switches Cisco Catalyst de la serie 9200 podr\u00eda permitir a un atacante f\u00edsico no autenticado ejecutar c\u00f3digo no firmado en el momento del arranque del sistema. Esta vulnerabilidad es debido a una comprobaci\u00f3n inapropiada en la funci\u00f3n del c\u00f3digo que administra la verificaci\u00f3n de las firmas digitales de los archivos de imagen del sistema durante el proceso de arranque inicial. Un atacante podr\u00eda explotar esta vulnerabilidad al cargar software no firmado en un dispositivo afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante arrancar una imagen de software malicioso o ejecutar c\u00f3digo no firmado y omitir la parte de verificaci\u00f3n de la imagen del proceso de arranque del dispositivo afectado. Para explotar esta vulnerabilidad, el atacante necesita un acceso f\u00edsico no autenticado al dispositivo o un acceso privilegiado al shell root del dispositivo. Nota: En versiones 16.11.1 y posteriores del software Cisco IOS XE, el acceso al shell root est\u00e1 protegido por el mecanismo de token de consentimiento. Sin embargo, un atacante con privilegios de nivel 15 podr\u00eda f\u00e1cilmente degradar el software Cisco IOS XE que es ejecutado en un dispositivo a una versi\u00f3n en la que el acceso al shell root est\u00e1 m\u00e1s disponible"}], "id": "CVE-2022-20944", "lastModified": "2024-11-21T06:43:52.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "ykramarz@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-10T21:15:10.480", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "ykramarz@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-347"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}