CVE-2022-20652 - Cisco Tetration Command Injection Vulnerability

Back Back to CVE browser

MEDIUM

Cisco Tetration Command Injection Vulnerability

Published Nov 15, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 1.33%

Description

A vulnerability in the web-based management interface and in the API subsystem of Cisco Tetration could allow an authenticated, remote attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted HTTP message to the affected system. A successful exploit could allow the attacker to execute commands with root-level privileges. To exploit this vulnerability, an attacker would need valid administrator-level credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected products

Vendor Cisco Product Cisco Secure Workload Default
n/a
- Version
  1.102.21
  Status
  affected
  Constraints
  -
- Version
  1.103.1.12
  Status
  affected
  Constraints
  -
- Version
  2.0.1.34
  Status
  affected
  Constraints
  -
- Version
  2.0.2.20
  Status
  affected
  Constraints
  -
- Version
  2.1.1.29
  Status
  affected
  Constraints
  -
- Version
  2.1.1.31
  Status
  affected
  Constraints
  -
- Version
  2.1.1.33
  Status
  affected
  Constraints
  -
- Version
  2.2.1.35
  Status
  affected
  Constraints
  -
- Version
  2.2.1.39
  Status
  affected
  Constraints
  -
- Version
  2.2.1.41
  Status
  affected
  Constraints
  -
- Version
  2.3.1.41
  Status
  affected
  Constraints
  -
- Version
  2.3.1.45
  Status
  affected
  Constraints
  -
- Version
  2.3.1.49
  Status
  affected
  Constraints
  -
- Version
  2.3.1.50
  Status
  affected
  Constraints
  -
- Version
  2.3.1.51
  Status
  affected
  Constraints
  -
- Version
  2.3.1.52
  Status
  affected
  Constraints
  -
- Version
  2.3.1.53
  Status
  affected
  Constraints
  -
- Version
  3.1.1.53
  Status
  affected
  Constraints
  -
- Version
  3.1.1.54
  Status
  affected
  Constraints
  -
- Version
  3.1.1.59
  Status
  affected
  Constraints
  -
- Version
  3.1.1.61
  Status
  affected
  Constraints
  -
- Version
  3.1.1.65
  Status
  affected
  Constraints
  -
- Version
  3.1.1.67
  Status
  affected
  Constraints
  -
- Version
  3.1.1.70
  Status
  affected
  Constraints
  -
- Version
  3.2.1.18
  Status
  affected
  Constraints
  -
- Version
  3.2.1.19
  Status
  affected
  Constraints
  -
- Version
  3.2.1.20
  Status
  affected
  Constraints
  -
- Version
  3.2.1.28
  Status
  affected
  Constraints
  -
- Version
  3.3.2.12
  Status
  affected
  Constraints
  -
- Version
  3.3.2.16
  Status
  affected
  Constraints
  -
- Version
  3.3.2.2
  Status
  affected
  Constraints
  -
- Version
  3.3.2.23
  Status
  affected
  Constraints
  -
- Version
  3.3.2.28
  Status
  affected
  Constraints
  -
- Version
  3.3.2.33
  Status
  affected
  Constraints
  -
- Version
  3.3.2.35
  Status
  affected
  Constraints
  -
- Version
  3.3.2.42
  Status
  affected
  Constraints
  -
- Version
  3.3.2.5
  Status
  affected
  Constraints
  -
- Version
  3.3.2.50
  Status
  affected
  Constraints
  -
- Version
  3.3.2.53
  Status
  affected
  Constraints
  -
- Version
  3.4.1.1
  Status
  affected
  Constraints
  -
- Version
  3.4.1.14
  Status
  affected
  Constraints
  -
- Version
  3.4.1.19
  Status
  affected
  Constraints
  -
- Version
  3.4.1.20
  Status
  affected
  Constraints
  -
- Version
  3.4.1.28
  Status
  affected
  Constraints
  -
- Version
  3.4.1.34
  Status
  affected
  Constraints
  -
- Version
  3.4.1.35
  Status
  affected
  Constraints
  -
- Version
  3.4.1.6
  Status
  affected
  Constraints
  -
- Version
  3.5.1.1
  Status
  affected
  Constraints
  -
- Version
  3.5.1.17
  Status
  affected
  Constraints
  -
- Version
  3.5.1.2
  Status
  affected
  Constraints
  -
- Version
  3.5.1.20
  Status
  affected
  Constraints
  -
- Version
  3.5.1.23
  Status
  affected
  Constraints
  -
- Version
  3.5.1.30
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Secure Workload

n/a

Version	Status	Constraints
1.102.21	affected	-
1.103.1.12	affected	-
2.0.1.34	affected	-
2.0.2.20	affected	-
2.1.1.29	affected	-
2.1.1.31	affected	-
2.1.1.33	affected	-
2.2.1.35	affected	-
2.2.1.39	affected	-
2.2.1.41	affected	-
2.3.1.41	affected	-
2.3.1.45	affected	-
2.3.1.49	affected	-
2.3.1.50	affected	-
2.3.1.51	affected	-
2.3.1.52	affected	-
2.3.1.53	affected	-
3.1.1.53	affected	-
3.1.1.54	affected	-
3.1.1.59	affected	-
3.1.1.61	affected	-
3.1.1.65	affected	-
3.1.1.67	affected	-
3.1.1.70	affected	-
3.2.1.18	affected	-
3.2.1.19	affected	-
3.2.1.20	affected	-
3.2.1.28	affected	-
3.3.2.12	affected	-
3.3.2.16	affected	-
3.3.2.2	affected	-
3.3.2.23	affected	-
3.3.2.28	affected	-
3.3.2.33	affected	-
3.3.2.35	affected	-
3.3.2.42	affected	-
3.3.2.5	affected	-
3.3.2.50	affected	-
3.3.2.53	affected	-
3.4.1.1	affected	-
3.4.1.14	affected	-
3.4.1.19	affected	-
3.4.1.20	affected	-
3.4.1.28	affected	-
3.4.1.34	affected	-
3.4.1.35	affected	-
3.4.1.6	affected	-
3.5.1.1	affected	-
3.5.1.17	affected	-
3.5.1.2	affected	-
3.5.1.20	affected	-
3.5.1.23	affected	-
3.5.1.30	affected	-

Vendor Cisco Product Secure Workload Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <3.5.1.37

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Secure Workload

n/a

Version	Status	Constraints
0	affected	<3.5.1.37

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

Link	Providers	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tetr-cmd-injc-skrwGO
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-FmbPu2pe