Medium severity · published Jul 21, 2022
CVE-2022-20908
Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Cisco Nexus Dashboard · Cisco
All versions, or not specified · source: vendor
ND
Nexus Dashboard · Cisco
2.0 before 2.2\(1e\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-20908
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-20908
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mprvesc-EMhDgXe5
More from Cisco Nexus Dashboard
9.9
CVE-2026-20325
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command
9.9
CVE-2026-20322
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control
9.8
CVE-2026-20326
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function
9.8
CVE-2022-20857
Cisco Nexus Dashboard Unauthorized Access Vulnerabilities
9.8
CVE-2022-20858
Cisco Nexus Dashboard Unauthorized Access Vulnerabilities
