CVE-2022-20830: Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability
First published: Mon Oct 10 2022(Updated: )
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC without authentication. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Catalyst SD-WAN Manager | >=20.4<20.6.1 | |
| Cisco Catalyst SD-WAN Manager | =20.7 | |
| Cisco SD-WAN vManage | >=18.4<20.3.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-20830?
CVE-2022-20830 is a vulnerability in the authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage, which allows an unauthenticated, remote attacker to access the GUI without authentication.
How does CVE-2022-20830 impact Cisco Catalyst SD-WAN Manager?
Cisco Catalyst SD-WAN Manager versions 20.4.0 to 20.6.1 are affected by CVE-2022-20830.
Which version of Cisco Catalyst SD-WAN Manager is affected by CVE-2022-20830?
Cisco Catalyst SD-WAN Manager versions 20.4.0 to 20.6.1 are affected by CVE-2022-20830.
How does CVE-2022-20830 impact Cisco SD-WAN vManage?
Cisco SD-WAN vManage versions 18.4.0 to 20.3.4.1 are affected by CVE-2022-20830.
How severe is CVE-2022-20830?
CVE-2022-20830 has a CVSS severity rating of 5.3, which is considered medium.
How can I fix CVE-2022-20830?
To fix CVE-2022-20830, Cisco recommends upgrading Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage to a fixed software release.
Where can I find more information about CVE-2022-20830?
You can find more information about CVE-2022-20830 on the Cisco Security Advisory website.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco catalyst sd-wan manager
- version/cisco catalyst sd-wan manager/20.4
- version/cisco catalyst sd-wan manager/20.7
- canonical/cisco sd-wan vmanage
- version/cisco sd-wan vmanage/18.4