CVE-2022-20650— Cisco NX-OS Software NX-API Command Injection Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-20650
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco NX-OS Software NX-API Command Injection Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation of user supplied data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP POST request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system. Note: The NX-API feature is disabled by default.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco NX-OS Software 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco NX-OS Software是美国思科（Cisco）公司的一套交换机使用的数据中心级操作系统软件。 Cisco NX-OS Software 中存在操作系统命令注入漏洞，该漏洞源于产品未对用户发起的HTTP POST请求数据中的内容进行有效验证。攻击者可通过该漏洞执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco NX-OS Software | n/a | - |
II. Public POCs for CVE-2022-20650
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-20650
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nxapi-cmdinject-ULukNMZ2vendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2022-20650
Same Patch Batch · Cisco · 2022-02-23 · 4 CVEs total
| CVE-2022-20623 | 8.6 HIGH | Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service Vuln |
| CVE-2022-20624 | 8.6 HIGH | Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service Vulnerability |
| CVE-2022-20625 | 4.3 MEDIUM | Cisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service Vulnerabi |
IV. Related Vulnerabilities
Same product: Cisco NX-OS Software
- CVE-2026-20010
Cisco Nexus 3000 and 9000 Series Switches Link Layer Discove - CVE-2026-20051
Cisco Nexus 3600-R and 9500-R Series Switching Platforms Lay - CVE-2025-20241
Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol <TB - CVE-2025-20262
Cisco Nexus 3000 and 9000 Series Switches Protocol Independe - CVE-2025-20290
Cisco NXOS Software Sensitive Log Information Disclosure Vul
Same vendor: Cisco
- CVE-2026-20224
Cisco Catalyst SD-WAN Manager XML External Entity Injection - CVE-2026-20210
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerabi - CVE-2026-20209
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerabi - CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulne - CVE-2026-20219
Cisco Slido 安全漏洞
Same weakness: CWE-78
V. Comments for CVE-2022-20650
No comments yet