The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage arises from incorrect path name restrictions related to restricted access directories. This vulnerability allows attackers to create or re-record critical files.

🗓️ 24 Dec 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Incorrect path restrictions in Cisco SD-WAN components allow creating or overwriting critical root files via CLI.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2022-20818	28 Sep 202216:00	–	attackerkb
Circl	CVE-2022-20818	30 Sep 202222:36	–	circl
Cisco	Cisco SD-WAN Software Privilege Escalation Vulnerabilities	28 Sep 202216:00	–	cisco
Tenable Nessus	Cisco SD-WAN Software Privilege Escalation Vulnerabilities (cisco-sa-sd-wan-priv-E6e8tEdF)	29 Sep 202200:00	–	nessus
CNNVD	Cisco SD-WAN 路径遍历漏洞	28 Sep 202200:00	–	cnnvd
CNVD	Cisco SD-WAN Access Control Error Vulnerability	30 Sep 202200:00	–	cnvd
CVE	CVE-2022-20818	30 Sep 202218:45	–	cve
Cvelist	CVE-2022-20818 Cisco SD-WAN Software Privilege Escalation Vulnerabilities	30 Sep 202218:45	–	cvelist
GithubExploit	Exploit for Path Traversal in Cisco Sd-Wan_Vbond_Orchestrator	13 Jan 202400:17	–	githubexploit
EUVD	EUVD-2022-26068	3 Oct 202520:07	–	euvd

Vulners

Node

cisco_systems catalyst_sd-wan_managerRange20.6–20.6.3

OR

cisco_systems catalyst_sd-wan_managerRange20.7–20.7.2

OR

cisco_systems sd-wan_vbond_orchestrator_softwareRange20.7–20.7.2

OR

cisco_systems sd-wan_vbond_orchestrator_softwareMatch20.8

OR

cisco_systems catalyst_sd-wan_managerMatch20.8

OR

cisco_systems cisco_catalyst_sd-wan_controllerRange20.7–20.7.2

OR

cisco_systems cisco_catalyst_sd-wan_controllerMatch20.8

OR

cisco_systems sd-wan_vbond_orchestrator_softwareRange20.6–20.6.3

OR

cisco_systems sd-wan_vedge_cloudRange20.6–20.6.3

OR

cisco_systems sd-wan_vedge_cloudRange20.7–20.7.2

OR

cisco_systems sd-wan_vedge_cloudMatch20.8

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-20818
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
web	www.web.nvd.nist.gov/view/vuln/detail

24 Dec 2022 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 26.8

CVSS 37.8

EPSS0.00517

Cisco SD-WAN vBond Orchestrator vEdge Cloud Routers vEdge Routers vSmart Controller vManage command line interface path name restrictions restricted directories root user critical files