CVE-2022-20734

Medium

Description

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

SeverityMedium

CVSS4.4

Exploit probability—

Product

Cisco Catalyst Sd-wan Manager

PublishedMay 4, 2022

First seenMay 4, 2022

Weakness typeCWE-497CWE-497

How to fix

Update

cisco catalyst_sd-wan_manager20.6.3, 20.7.2 or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmge-infodc-WPSkAMhp

Affected products

Product	Affected versions	Fixed in
cisco catalyst_sd-wan_manager	20.6 ≤ v < 20.6.3, 20.7 ≤ v < 20.7.2	20.6.3, 20.7.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.