Vulnerability · Published Jul 21, 2022 · Assigned by cisco

CVE-2022-20906Cisco Nexus Dashboard Privilege Escalation Vulnerabilities

Medium 6.0

In plain English

A medium-severity security flaw in Cisco Nexus Dashboard from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Nexus Dashboard	n/a

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

20220720 Cisco Nexus Dashboard Privilege Escalation Vulnerabilities vendor-advisory, x_refsource_CISCO