CVE-2022-20855

Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points Privilege Escalation Vulnerability

MEDIUM

6.7

CVSS Score

Published: September 30, 2022 at 06:46 PM UTC

Updated: June 17, 2026 at 04:25 AM UTC

30 products affected across 1 vendorIOS XeCatalyst 9800-LCatalyst 9800-80

Using Cisco IOS XE Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XE Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.7

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xe · Cisco

95%

17.6.1

cisco-catalyst-9105 (environment) · cisco-catalyst-9105axi (environment) · cisco-catalyst-9105axw (environment) · cisco-catalyst-9115 (environment) · cisco-catalyst-9115-ap (environment) · cisco-catalyst-9115axe (environment) · cisco-catalyst-9115axi (environment) · cisco-catalyst-9117 (environment) · cisco-catalyst-9117-ap (environment) · cisco-catalyst-9117axi (environment) · cisco-catalyst-9120 (environment) · cisco-catalyst-9120-ap (environment) · cisco-catalyst-9120axe (environment) · cisco-catalyst-9120axi (environment) · cisco-catalyst-9120axp (environment) · cisco-catalyst-9124 (environment) · cisco-catalyst-9124axd (environment) · cisco-catalyst-9124axi (environment) · cisco-catalyst-9130 (environment) · cisco-catalyst-9130-ap (environment) · cisco-catalyst-9130axe (environment) · cisco-catalyst-9130axi (environment) · cisco-catalyst-9800 (environment) · cisco-catalyst-9800-40 (environment) · cisco-catalyst-9800-80 (environment) · cisco-catalyst-9800-cl (environment) · cisco-catalyst-9800-l (environment) · cisco-catalyst-9800-l-c (environment) · cisco-catalyst-9800-l-f (environment)

Catalyst 9105 · Ciscodevice

80%

All versions

Catalyst 9105Axi · Ciscodevice

80%

All versions

Catalyst 9105Axw · Ciscodevice

80%

All versions

Catalyst 9115 · Ciscodevice

80%

All versions