High severity · published Sep 30, 2022
CVE-2022-20818
Cisco SD-WAN Software Privilege Escalation Vulnerabilities
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cisco SD-WAN Solution · Cisco
All versions, or not specified · source: vendor
SD
Sd-wan · Cisco
before 20.9 · source: NVD
SV
Sd-wan Vbond Orchestrator · Cisco
before 20.9 · source: NVD
SV
Sd-wan Vmanage · Cisco
before 20.9 · source: NVD
SV
Sd-wan Vsmart Controller · Cisco
before 20.9 · source: NVD
Affected product
CS
Cisco SD-WAN Solution
Cisco
More from Cisco SD-WAN Solution
8.8
CVE-2019-1650
Cisco SD-WAN Solution Arbitrary File Overwrite Vulnerability
8.8
CVE-2019-1651
Cisco SD-WAN Solution Buffer Overflow Vulnerability
8.0
CVE-2019-1647
Cisco SD-WAN Solution Unauthorized Access Vulnerability
7.8
CVE-2019-1648
Cisco SD-WAN Solution Privilege Escalation Vulnerability
7.8
CVE-2019-1646
Privilege Escalation Vulnerability in Cisco SD-WAN Solution