CVE-2022-20830: Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC without authentication. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-20830?
CVE-2022-20830 is a vulnerability in the authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage, which allows an unauthenticated, remote attacker to access the GUI without authentication.
How does CVE-2022-20830 impact Cisco Catalyst SD-WAN Manager?
Cisco Catalyst SD-WAN Manager versions 20.4.0 to 20.6.1 are affected by CVE-2022-20830.
Which version of Cisco Catalyst SD-WAN Manager is affected by CVE-2022-20830?
Cisco Catalyst SD-WAN Manager versions 20.4.0 to 20.6.1 are affected by CVE-2022-20830.
How does CVE-2022-20830 impact Cisco SD-WAN vManage?
Cisco SD-WAN vManage versions 18.4.0 to 20.3.4.1 are affected by CVE-2022-20830.
How severe is CVE-2022-20830?
CVE-2022-20830 has a CVSS severity rating of 5.3, which is considered medium.
How can I fix CVE-2022-20830?
To fix CVE-2022-20830, Cisco recommends upgrading Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage to a fixed software release.
Where can I find more information about CVE-2022-20830?
You can find more information about CVE-2022-20830 on the Cisco Security Advisory website.