CVE-2022-20777
published 2022-05-04CVE-2022-20777: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the…
PriorityP267critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
10.76%
95.3th percentile
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_enterprise_nfv_infrastructure_software | — | — |
| cisco | enterprise_nfv_infrastructure | — | — |
| cisco | enterprise_nfv_infrastructure_software | < 4.7.1 | 4.7.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2022-20777 affects Cisco Enterprise NFV Infrastructure Software (NFVIS); monitor for guest VM to host machine escape activity, which may manifest as unexpected root-level process execution originating from a guest VM context. ↗
- →Track Cisco bug IDs CSCvz73971, CSCvz73973, and CSCvz73988 for patch status; unpatched NFVIS instances should be prioritized for detection coverage around command injection at root level. ↗
- ·CWE-611 (XML External Entity) is one of the weakness types associated with this CVE, suggesting that XML input handling in NFVIS may be an attack vector; ensure XML parsing interfaces are not exposed to untrusted guest VMs. ↗
- ·CWE-284 (Improper Access Control) is also associated with this CVE; review NFVIS guest VM privilege boundaries and access control configurations to limit lateral movement from guest to host. ↗
- ·There are no workarounds available for these vulnerabilities; software updates from Cisco are the only remediation path. ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Enterprise NFV Infrastructure Software Vulnerabilities
vendor_cisco·2022-05-04·CVSS 9.9
CVE-2022-20777 [CRITICAL] CWE-284 Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9
Cisco
Cisco Enterprise NFV Infrastructure Software Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2022-20777 Cisco Enterprise NFV Infrastructure Software Vulnerabilities
CVE-2022-20777: Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-284, CWE-611, CWE-284, CWE-611
Bug IDs: CSCvz73971, CSCvz73973, CSCvz73988, CSCvz73973, CSCvz73988
GHSA
GHSA-w4mh-9fw9-766v: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM)
ghsa_unreviewed·2022-05-05
CVE-2022-20777 [CRITICAL] CWE-284 GHSA-w4mh-9fw9-766v: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM)
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.
No detection rules found.
No public exploits indexed.
https://github.com/orangecertcc/security-research/security/advisories/GHSA-v56f-9gq3-rx3ghttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9https://github.com/orangecertcc/security-research/security/advisories/GHSA-v56f-9gq3-rx3ghttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9
2022-05-04
Published