CVE-2022-20871

A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. To successfully exploit this vulnerability, an attacker would need at least read-only credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .

• CWE-78

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecUNot Applicable
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dvNot Applicable
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8Vendor Advisory

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20866A vulnerability in the handling of RSA keys on devices runni…7.5
• CVE-2022-20867A vulnerability in web-based management interface of the of …6.5
• CVE-2022-20868A vulnerability in the web-based management interface of Cis…8.8
• CVE-2022-20869A vulnerability in the web-based management interface of Cis…6.1
• CVE-2022-2087A vulnerability, which was classified as problematic, was fo…4.8
• CVE-2022-20870A vulnerability in the egress MPLS packet processing functio…8.6
• CVE-2022-20872Multiple vulnerabilities in the web-based management interfa…4.8
• CVE-2022-20873Multiple vulnerabilities in the web-based management interfa…7.2
• CVE-2022-20874Multiple vulnerabilities in the web-based management interfa…7.2
• CVE-2022-20875Multiple vulnerabilities in the web-based management interfa…7.2
• CVE-2022-20876Multiple vulnerabilities in the web-based management interfa…7.2
• CVE-2022-20877Multiple vulnerabilities in the web-based management interfa…7.2