CVE-2022-20929: High severity cisco enterprise network functions virtualization infrastructure software vulnerability
A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade files. An attacker could exploit this vulnerability by providing an administrator with an unauthentic upgrade file. A successful exploit could allow the attacker to fully compromise the Cisco NFVIS system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-20929?
CVE-2022-20929 is a vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) that could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload.
How does CVE-2022-20929 affect Cisco Enterprise NFV Infrastructure Software?
CVE-2022-20929 affects Cisco Enterprise NFV Infrastructure Software versions 3.5.1 to 4.9.1.
What is the severity of CVE-2022-20929?
The severity of CVE-2022-20929 is high with a CVSS score of 7.8.
How can an attacker exploit CVE-2022-20929?
An unauthenticated, local attacker can exploit CVE-2022-20929 by providing an unauthentic upgrade file for upload.
Is there a fix available for CVE-2022-20929?
Yes, Cisco has released a security advisory with mitigation details for CVE-2022-20929. Please refer to the Cisco Security Advisory for more information.