CVE-2022-20775

HIGHCISA KEV

7.8

Descricao

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Detalhes CVE

Pontuacao CVSS v3.17.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado9/30/2022

Ultima modificacao2/26/2026

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorCisco

ProdutoSD-WAN

Nome da vulnerabilidadeCisco SD-WAN Path Traversal Vulnerability

Data inclusao KEV2026-02-25

Prazo de remediacao2026-02-27

Uso em ransomwareUnknown

Produtos afetados

cisco:1100-4g_integrated_services_routercisco:1100-4p_integrated_services_routercisco:1100-6g_integrated_services_routercisco:1100-8p_integrated_services_routercisco:1100_integrated_services_routercisco:1101-4p_integrated_services_routercisco:1101_integrated_services_routercisco:1109-2p_integrated_services_routercisco:1109-4p_integrated_services_routercisco:1109_integrated_services_routercisco:1111x-8p_integrated_services_routercisco:1111x_integrated_services_routercisco:111x_integrated_services_routercisco:1120_integrated_services_routercisco:1131_integrated_services_routercisco:1160_integrated_services_routercisco:4000_integrated_services_routercisco:4221_integrated_services_routercisco:4321\/k9-rf_integrated_services_routercisco:4321\/k9-ws_integrated_services_routercisco:4321\/k9_integrated_services_routercisco:4321_integrated_services_routercisco:4331\/k9-rf_integrated_services_routercisco:4331\/k9-ws_integrated_services_routercisco:4331\/k9_integrated_services_routercisco:4331_integrated_services_routercisco:4351\/k9-rf_integrated_services_routercisco:4351\/k9-ws_integrated_services_routercisco:4351\/k9_integrated_services_routercisco:4351_integrated_services_routercisco:4431_integrated_services_routercisco:4451-x_integrated_services_routercisco:4451_integrated_services_routercisco:4461_integrated_services_routercisco:8101-32fhcisco:8101-32hcisco:8102-64hcisco:8201cisco:8201-32fhcisco:8202cisco:8804cisco:8808cisco:8812cisco:8818cisco:8831cisco:asr_1000cisco:asr_1000-xcisco:asr_1001cisco:asr_1001-hxcisco:asr_1001-hx_rcisco:asr_1001-xcisco:asr_1001-x_rcisco:asr_1002cisco:asr_1002-hxcisco:asr_1002-hx_rcisco:asr_1002-xcisco:asr_1002-x_rcisco:asr_1004cisco:asr_1006cisco:asr_1006-xcisco:asr_1009-xcisco:asr_1013cisco:asr_1023cisco:catalyst_8000v_edgecisco:catalyst_8200cisco:catalyst_8300cisco:catalyst_8300-1n1s-4t2xcisco:catalyst_8300-1n1s-6tcisco:catalyst_8300-2n2s-4t2xcisco:catalyst_8300-2n2s-6tcisco:catalyst_8500cisco:catalyst_8500-4qccisco:catalyst_8500lcisco:catalyst_8510csrcisco:catalyst_8510msrcisco:catalyst_8540csrcisco:catalyst_8540msrcisco:catalyst_cg418-ecisco:catalyst_cg522-ecisco:catalyst_sd-wan_managercisco:sd-wancisco:sd-wan_vbond_orchestratorcisco:sd-wan_vedge_cloudcisco:sd-wan_vsmart_controller

Fraquezas (CWE)

CWE-25CWE-22

Referencias

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF(psirt@cisco.com)

https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc(nvd@nist.gov)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF(nvd@nist.gov)

https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc(af854a3a-2127-422b-91ae-364da2661108)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.