Lucene search

[email protected]CVE-2022-20929

HistoryMar 10, 2023 - 9:15 p.m.

CVE-2022-20929

2023-03-1021:15:10

CWE-347

[email protected]

web.nvd.nist.gov

512

cisco

nfvis

vulnerability

upgrade

signature verification

nvd

cve-2022-20929

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload.
This vulnerability is due to insufficient cryptographic signature verification of upgrade files. An attacker could exploit this vulnerability by providing an administrator with an unauthentic upgrade file. A successful exploit could allow the attacker to fully compromise the Cisco NFVIS system.

Affected configurations

NVD

Node

ciscoenterprise_nfv_infrastructure_softwareRange3.5.1–4.9.1

CPENameOperatorVersion
cisco:enterprise_nfv_infrastructure_softwarecisco enterprise nfv infrastructure softwarelt4.9.1

CPE	Name	Operator	Version
cisco:enterprise_nfv_infrastructure_software	cisco enterprise nfv infrastructure software	lt	4.9.1

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Enterprise NFV Infrastructure Software",
    "versions": [
      {
        "version": "3.5.1",
        "status": "affected"
      },
      {
        "version": "3.5.2",
        "status": "affected"
      },
      {
        "version": "3.6.1",
        "status": "affected"
      },
      {
        "version": "3.6.2",
        "status": "affected"
      },
      {
        "version": "3.6.3",
        "status": "affected"
      },
      {
        "version": "3.7.1",
        "status": "affected"
      },
      {
        "version": "3.8.1",
        "status": "affected"
      },
      {
        "version": "3.9.1",
        "status": "affected"
      },
      {
        "version": "3.9.2",
        "status": "affected"
      },
      {
        "version": "3.10.1",
        "status": "affected"
      },
      {
        "version": "3.10.2",
        "status": "affected"
      },
      {
        "version": "3.10.3",
        "status": "affected"
      },
      {
        "version": "3.11.1",
        "status": "affected"
      },
      {
        "version": "3.11.2",
        "status": "affected"
      },
      {
        "version": "3.11.3",
        "status": "affected"
      },
      {
        "version": "3.12.1",
        "status": "affected"
      },
      {
        "version": "3.12.2",
        "status": "affected"
      },
      {
        "version": "3.12.3",
        "status": "affected"
      },
      {
        "version": "3.12.1a",
        "status": "affected"
      },
      {
        "version": "3.12.1b",
        "status": "affected"
      },
      {
        "version": "4.1.1",
        "status": "affected"
      },
      {
        "version": "4.1.2",
        "status": "affected"
      },
      {
        "version": "4.2.1",
        "status": "affected"
      },
      {
        "version": "4.4.2",
        "status": "affected"
      },
      {
        "version": "4.4.1",
        "status": "affected"
      },
      {
        "version": "4.5.1",
        "status": "affected"
      },
      {
        "version": "4.6.1",
        "status": "affected"
      },
      {
        "version": "4.6.2-FC3",
        "status": "affected"
      },
      {
        "version": "4.6.2",
        "status": "affected"
      },
      {
        "version": "4.6.3",
        "status": "affected"
      },
      {
        "version": "4.7.1",
        "status": "affected"
      },
      {
        "version": "4.8.1",
        "status": "affected"
      },
      {
        "version": "4.9.1",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-ISV-BQrvEv2h

Social References

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

Related for CVE-2022-20929

nvd1 cisco1 prion1 cvelist1