CVE-2022-20716
High
Description
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Cisco Sd-wan Solution
PublishedApr 15, 2022
First seenApr 15, 2022
Weakness typeCWE-284Improper access control
How to fix
Update
- cisco sd-wan20.6.1, 20.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco sd-wan_solution | No range specified | — |
| cisco catalyst_sd-wan_manager | No range specified | — |
| cisco sd-wan_vbond_orchestrator | No range specified | — |
| cisco sd-wan_vedge_cloud | No range specified | — |
| cisco sd-wan_vedge_router | No range specified | — |
| cisco sd-wan_vsmart_controller_software | No range specified | — |
| cisco sd-wan | 18.4 ≤ v < 20.6.1, 20.7 ≤ v < 20.7.1 | 20.6.1, 20.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.