CVE-2022-20734: A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This…

PriorityP418medium4.4CVSS 3.1

AVLACLPRHUINSUCHINAN

EPSS

0.23%

14.1th percentile

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
cisco	catalyst_sd-wan_manager	>= 20.6 < 20.6.3	20.6.3
cisco	catalyst_sd-wan_manager	>= 20.7 < 20.7.2	20.7.2
cisco	cisco_sd-wan_vmanage	—	—
cisco	sd-wan_vmanage	—	—

CVSS provenance

nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N

vendor_cisco4.4MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.