Cisco RCM for StarOS Software Vulnerability Could Lead to Information Disclosure

CVE-2022-20648

What is CVE-2022-20648?

A vulnerability exists in the debug functionality of Cisco RCM for Cisco StarOS Software that may permit unauthenticated, remote attackers to execute debug commands. This could lead to unauthorized access to sensitive information intended to be kept confidential. The vulnerability arises from a debug service that improperly listens for and accepts connections, thereby allowing exploitation through the debug port. Cisco has issued updates for their software to mitigate this issue, and no effective workarounds are available.

References