Vulnerability · Published May 4, 2022 · Assigned by cisco

CVE-2022-20779Cisco Enterprise NFV Infrastructure Software Vulnerabilities

Critical 9.9

In plain English

A critical-severity improper access control in Cisco Enterprise NFV Infrastructure Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)10.5%top 4.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Enterprise NFV Infrastructure Software	n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

20220504 Cisco Enterprise NFV Infrastructure Software Vulnerabilities vendor-advisory, x_refsource_CISCO
https://github.com/orangecertcc/security-research/security/advisories/GHSA-77vw-2pmg-q492 x_refsource_MISC