Cisco Crosswork
CVE-2026-20220
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network vector via web interface, low complexity once credentials held; PR:L reflects mandatory write-permissioned template account; limited C/I/A due to scoped filesystem access.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to execute arbitrary commands on an affected device.
This vulnerability is due to insufficient input validation in the configuration template engine of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system in limited areas of the file system. This vulnerability affects only areas of the operating system for which the template user has write permissions. To exploit this vulnerability, the attacker must have valid template user credentials with write permissions. Template users with read permissions cannot exploit this vulnerability.
AnalysisAI
Authenticated remote OS command injection in Cisco Crosswork Network Controller's web-based management interface allows a threat actor holding valid template user credentials with write permissions to execute arbitrary commands on the underlying operating system. The flaw resides in the configuration template engine, which fails to adequately validate attacker-supplied input before processing it, enabling CWE-74 injection. Impact is bounded to filesystem areas where the template user holds write access, reducing blast radius compared to full OS compromise; however, on a network automation controller, even scoped command execution can expose sensitive network configurations and automation workflows. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically within the configuration template engine of Cisco Crosswork's web management interface. Template engines parse and render structured input and, when user-supplied data is not sanitized before being passed to downstream interpreters (shell, OS command executor), crafted metacharacters or directives can break out of the intended template context and inject operating-system commands. The affected product, identified by CPE cpe:2.3:a:cisco:cisco_crosswork_network_change_automation:*:*:*:*:*:*:*:*, is Cisco Crosswork Network Change Automation - a platform used to orchestrate and automate network configuration changes at scale. Because the platform itself has privileged access to managed network devices, even limited OS-level code execution on its host carries elevated operational risk beyond what the CVSS metrics alone convey.
RemediationAI
Consult the Cisco Security Advisory cisco-sa-cnc-inj-QNMeEmxk at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnc-inj-QNMeEmxk for exact fixed software versions and upgrade instructions, as no specific patched version was enumerated in the available intelligence data - patch availability is confirmed per vendor advisory but the precise fix version must be obtained from Cisco directly. As an immediate compensating control, audit all accounts assigned the template user role and revoke write permissions from any accounts where write access is not operationally required, since template users with read-only permissions cannot exploit this vulnerability. Additionally, restrict access to the Crosswork web management interface at the network perimeter to trusted administrator source IPs only, reducing the attack surface to the internal network rather than broad network exposure. Monitor template engine activity and web interface logs for anomalous or unexpected OS-level command patterns as a detection measure while patching is scheduled.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today