CVE-2022-20652

A vulnerability in the web-based management interface and in the API subsystem of Cisco Tetration could allow an authenticated, remote attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted HTTP message to the affected system. A successful exploit could allow the attacker to execute commands with root-level privileges. To exploit this vulnerability, an attacker would need valid administrator-level credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

• CWE-78

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tetr-cmd-injc-skrwGO
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-FmbPu2pe

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20647Multiple vulnerabilities in the web-based management interfa…6.1
• CVE-2022-20648A vulnerability in a debug function for Cisco RCM for C…5.3
• CVE-2022-20649A vulnerability in Cisco RCM for Cisco StarOS Soft…8.1
• CVE-2022-2065Cross-site Scripting (XSS) - Stored in GitHub repository neo…5.4
• CVE-2022-20650A vulnerability in the NX-API feature of Cisco NX-OS Softwar…8.8
• CVE-2022-20651A vulnerability in the logging component of Cisco Adaptive S…5.5
• CVE-2022-20653A vulnerability in the DNS-based Authentication of Named Ent…7.5
• CVE-2022-20654A vulnerability in the web-based interface of Cisco Web…6.1
• CVE-2022-20655A vulnerability in the implementation of the CLI on a device…8.8
• CVE-2022-20656A vulnerability in the web-based management interface of Cis…6.5
• CVE-2022-20657A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-20658A vulnerability in the web-based management interface of Cis…9.6