A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.
History

Fri, 01 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2022-09-30T18:46:15.252083Z

Updated: 2024-11-01T18:50:27.164Z

Reserved: 2021-11-02T00:00:00

Link: CVE-2022-20855

cve-icon Vulnrichment

Updated: 2024-08-03T02:24:50.248Z

cve-icon NVD

Status : Modified

Published: 2022-09-30T19:15:12.963

Modified: 2024-11-21T06:43:41.627

Link: CVE-2022-20855

cve-icon Redhat

No data.