Medium severity4.6NVD Advisory· Published Oct 10, 2022· Updated Jun 17, 2026

CVE-2022-20864

Description

A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot variable permissions in ROMMON. An attacker could exploit this vulnerability by rebooting the switch into ROMMON and entering specific commands through the console. A successful exploit could allow the attacker to read any file or reset the enable password.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisco Systems, Inc./Catalyst Switchesllm-fuzzy
Cisco Systems, Inc./IOS XE ROM Monitor (ROMMON) Softwarellm-fuzzy
Cisco Systems, Inc./IOS XE Software for Cisco Merakicpe-rescue
Range: n/a

Patches

Vulnerability mechanics

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-info-disc-nrORXjOnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000