Vulnerability · Published Sep 30, 2022 · Assigned by cisco

CVE-2022-20818Cisco SD-WAN Software Privilege Escalation Vulnerabilities

High 7.8

In plain English

A high-severity security flaw in Cisco SD-WAN Solution from Cisco. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.6%top 50.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco SD-WAN Solution	n/a

Weakness: CWE-25 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

20220928 Cisco SD-WAN Software Privilege Escalation Vulnerabilities vendor-advisory, x_refsource_CISCO