CVE-2022-20695

highpriority · attend · 47EPSS 0.198 · 97 %ileEURUUS
grimoire priorityP1 · Urgent
Exploitable?
—
no known exploitation
Likely / severe?
19.8% (97th) EPSS
CVSS 9.3 · high
Is it mine?
12 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · scored 2026-10-27

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of the password validation algorithm. An attacker could exploit this vulnerability by logging in to an affected device with crafted credentials. A successful exploit could allow the attacker to bypass authentication and log in to the device as an administrator. The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials. Note: This vulnerability exists because of a non-default device configuration that must be present for it to be exploitable. For details about the vulnerable configuration, see the Vulnerable Products section of this advisory.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco 3500 Series Wireless Controllerscisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco 5500 Series Wireless Controllerscisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco 8500 Series Wireless Controllerscisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco Virtual Wireless Controllercisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco 3500 Series Wireless Controllerscisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco 5500 Series Wireless Controllerscisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco 8500 Series Wireless Controllerscisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • FixedCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco Virtual Wireless Controllercisco_csaf

    Cisco has released software updates that address this vulnerability.

    https://software.cisco.com
  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco 3500 Series Wireless Controllerscisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco 5500 Series Wireless Controllerscisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco 8500 Series Wireless Controllerscisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.151.0 when installed on Cisco Virtual Wireless Controllercisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco 3500 Series Wireless Controllerscisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco 5500 Series Wireless Controllerscisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco 8500 Series Wireless Controllerscisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

  • WorkaroundCisco Wireless LAN Controller (WLC) 8.10.162.0 when installed on Cisco Virtual Wireless Controllercisco_csaf

    There are workarounds that addresses this vulnerability. Choose one of the following based on the environment: Option 1: No Macfilters in the Environment Customers who do not use macfilters can reset the macfilter radius compatibility mode to the default value using the following CLI command: wlc > config macfilter radius-compat cisco Option 2: Macfilters in the Environment Customers who use macfilters and who are able to change the radius server configuration to match other possible compatibility modes can modify the macfilter compatibility to either cisco or free using one of the following CLI commands: wlc > config macfilter radius-compat cisco wlc > config macfilter radius-compat free For more information about the different macfilter compatibility modes, see Cisco Wireless Controller Command Reference ["https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/cmd-ref/b-cr810/config_commands_j_to_q.html#wp4097683650"]. While these workarounds have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

02

cvss

Technical severity, 0–10. One row per scoring source.

10.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.1–10

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 10
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6
v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · psirt@cisco.com USexploitability 3.9 · impact 6
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USprimaryCWE-303USCWE-303US
05

affected products (12)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • cisco-sa-wlc-auth-bypass-JRNhV4fFCisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability2022-04-13csaf · cisco_csafUS

    A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of the password validation algorithm. An attacker could exploit this vulnerability by logging in to an affected device with crafted credentials. A successful exploit could allow the attacker to bypass authentication and log in to the device as an administrator. The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials. Note: This vulnerability exists because of a non-default device configuration that must be present for it to be exploitable. For details about the vulnerable configuration, see the Vulnerable Products ["#vp"] section of this advisory. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisco_csafnvdNVDCVE.orgMITRE
published 2022-04-15modified 2026-06-17
10

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan