CVE-2022-20964

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the web-based management interface. An attacker could exploit this vulnerability by manipulating requests to the web-based management interface to contain operating system commands. A successful exploit could allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user. Cisco has not yet released software updates that address this vulnerability.

• CWE-78
• CWE-78

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUxVendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUxVendor Advisory

Published

Jan 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20958A vulnerability in the web-based management interface of Cis…8.8
• CVE-2022-20959A vulnerability in the External RESTful Services (ERS) API o…5.4
• CVE-2022-20960A vulnerability in Cisco AsyncOS Software for Cisco Email Se…7.5
• CVE-2022-20961A vulnerability in the web-based management interface of Cis…8.8
• CVE-2022-20962A vulnerability in the Localdisk Management feature of Cisco…8.8
• CVE-2022-20963A vulnerability in the web-based management interface of Cis…5.4
• CVE-2022-20965A vulnerability in the web-based management interface of Cis…5.4
• CVE-2022-20966A vulnerability in the web-based management interface of Cis…5.4
• CVE-2022-20967A vulnerability in the web-based management interface of Cis…5.4
• CVE-2022-20968A vulnerability in the Cisco Discovery Protocol processing f…8.8
• CVE-2022-20969A vulnerability in multiple management dashboard pages of Ci…5.4
• CVE-2022-2097AES OCB mode for 32-bit x86 platforms using the AES-NI assem…5.3