Cisco Tetration Vulnerability Allowing Arbitrary Command Execution

CVE-2022-20652

Summary

A security flaw in the web-based management interface and API subsystem of Cisco Tetration enables an authenticated, remote attacker to inject arbitrary commands that execute with root-level privileges on the underlying operating system. Due to insufficient input validation, an attacker can craft a malicious HTTP message targeting the vulnerable system. Successful exploitation of this issue requires valid administrator-level credentials, which allows the attacker to gain control over critical system functions. Cisco has acknowledged the issue and released software updates to remediate the vulnerability, while no effective workarounds are available.

References