Lucene search

CiscoCVE-2022-20844

HistorySep 30, 2022 - 7:15 p.m.

CVE-2022-20844

2022-09-3019:15:11

CWE-798

cisco

web.nvd.nist.gov

cisco

sd-avc

vulnerability

authentication

cisco vmanage

cve-2022-20844

nvd

remote attacker

gui

exploit

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

45.4%

JSON

A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.

Affected configurations

Nvd

Node

ciscosd-wanRange20.4.1–20.6.3

ciscosd-wanMatch20.3.4.1

ciscosd-wanMatch20.3.4.2

ciscosd-wanMatch20.3.5

ciscosd-wanMatch20.7.1

VendorProductVersionCPE
ciscosd-wan*cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
ciscosd-wan20.3.4.1cpe:2.3:a:cisco:sd-wan:20.3.4.1:*:*:*:*:*:*:*
ciscosd-wan20.3.4.2cpe:2.3:a:cisco:sd-wan:20.3.4.2:*:*:*:*:*:*:*
ciscosd-wan20.3.5cpe:2.3:a:cisco:sd-wan:20.3.5:*:*:*:*:*:*:*
ciscosd-wan20.7.1cpe:2.3:a:cisco:sd-wan:20.7.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	sd-wan	*	cpe:2.3:a:cisco:sd-wan::::::::
cisco	sd-wan	20.3.4.1	cpe:2.3:a:cisco:sd-wan:20.3.4.1:::::::*
cisco	sd-wan	20.3.4.2	cpe:2.3:a:cisco:sd-wan:20.3.4.2:::::::*
cisco	sd-wan	20.3.5	cpe:2.3:a:cisco:sd-wan:20.3.5:::::::*
cisco	sd-wan	20.7.1	cpe:2.3:a:cisco:sd-wan:20.7.1:::::::*

CNA Affected

[
  {
    "product": "Cisco SD-WAN vManage",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdavc-ZA5fpXX2

Social References

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

45.4%

JSON

Related for CVE-2022-20844