CVE-2022-20930: Cisco SD-WAN Software Arbitrary File Corruption Vulnerability
First published: Fri Sep 30 2022(Updated: )
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Catalyst SD-WAN Manager | =20.8 | |
| Cisco Catalyst SD-WAN Manager | =20.9 | |
| Cisco Sd-wan Vbond Orchestrator | <20.6.2 | |
| Cisco Sd-wan Vbond Orchestrator | =20.8 | |
| Cisco Sd-wan Vbond Orchestrator | =20.9 | |
| Cisco SD-WAN vManage | <20.6.2 | |
| Cisco Sd-wan Vsmart Controller | <20.6.2 | |
| Cisco Sd-wan Vsmart Controller | =20.8 | |
| Cisco Sd-wan Vsmart Controller | =20.9 | |
| Cisco SD-WAN | <20.6.2 | |
| Cisco SD-WAN | =20.8 | |
| Cisco SD-WAN | =20.9 | |
| Cisco Vedge 100 | ||
| Cisco Vedge 1000 | ||
| Cisco Vedge 100b | ||
| Cisco Vedge 100m | ||
| Cisco Vedge 100wm | ||
| Cisco Vedge 2000 | ||
| Cisco Vedge 5000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-20930.
What is the severity of CVE-2022-20930?
The severity of CVE-2022-20930 is medium with a CVSS score of 6.7.
How does CVE-2022-20930 occur?
CVE-2022-20930 occurs due to insufficient input validation in the CLI of Cisco SD-WAN Software.
Who can exploit CVE-2022-20930?
An authenticated local attacker can exploit CVE-2022-20930.
How can CVE-2022-20930 be fixed?
Apply the necessary updates provided by Cisco to fix CVE-2022-20930.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/references
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco catalyst sd-wan manager
- version/cisco catalyst sd-wan manager/20.8
- version/cisco catalyst sd-wan manager/20.9
- canonical/cisco sd-wan vbond orchestrator
- version/cisco sd-wan vbond orchestrator/20.8
- version/cisco sd-wan vbond orchestrator/20.9
- canonical/cisco sd-wan vmanage
- canonical/cisco sd-wan vsmart controller
- version/cisco sd-wan vsmart controller/20.8
- version/cisco sd-wan vsmart controller/20.9
- canonical/cisco sd-wan
- version/cisco sd-wan/20.8
- version/cisco sd-wan/20.9
- canonical/cisco vedge 100
- canonical/cisco vedge 1000
- canonical/cisco vedge 100b
- canonical/cisco vedge 100m
- canonical/cisco vedge 100wm
- canonical/cisco vedge 2000
- canonical/cisco vedge 5000