Vulnerability Intelligence Report
Cisco NX-OS Software NX-API Command Injection Vulnerability
CVE-2022-20650
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation of user supplied data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP POST request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system. Note: The NX-API feature is disabled by default.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
Exploitability:2.9
Impact Score:5.9
EPSS Probability:14.55%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗CWE-78
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Cisco | Cisco NX-OS Software | n/a (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
14.550%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cisco Systems, Inc. · Hosted Service · USA |
| Reserved | 2021-11-02T00:00:00 |
| Published | 2022-02-23T17:40:10 |
| Patch Date | 2022-02-23 |
| Last Updated | 2024-11-06T16:29:59 |
Community Chatter & Buzz