CVE-2022-20716 — Improper Access Control in Cisco Sd-wan

CWE-284 — Improper Access Control4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 67.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Sd-wanCisco Sd-wan Solution
Timeline
PublishedApr 15
Latest updateApr 16

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/sd-wan18.4 — 20.6.1+1

🔴Vulnerability Details

2
GHSA
GHSA-467q-fpqj-82rx: A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges↗2022-04-16
▶
CVEList
Cisco SD-WAN Solution Improper Access Control Vulnerability↗2022-04-15
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Solution Improper Access Control Vulnerability↗2022-04-13
▶
CVE-2022-20716 — Improper Access Control in Cisco | cvebase