Critical severity · published May 4, 2022
CVE-2022-20777
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject…
9.9
CVSS
11.1%
EPSS
No
On KEV
Description
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)11.1% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Enterprise Nfv Infrastructure Software · Cisco
before 4.7.1 · source: NVD
Affected product
EN
Enterprise Nfv Infrastructure Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-20777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-20777
Exploit
https://github.com/orangecertcc/security-research/security/advisories/GHSA-v56f-9gq3-rx3g
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9
More from Enterprise Nfv Infrastructure Software
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
9.8
CVE-2021-34746
A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated,…
9.8
CVE-2020-3470
Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root…
9.8
CVE-2019-1971
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and…
9.8
CVE-2019-1895
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote…