Lucene search

CitrixCVE-2022-27506

HistoryApr 13, 2022 - 6:15 p.m.

CVE-2022-27506

2022-04-1318:15:14

CWE-798

Citrix

web.nvd.nist.gov

cve-2022-27506

hard-coded credentials

shell access

sd-wan cli

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI

Affected configurations

Nvd

Node

citrixsd-wan_110Match-

AND

citrixsd-wan_110_firmwareRange<11.4.1standard

Node

citrixsd-wan_210Match-

AND

citrixsd-wan_210_firmwareRange<11.4.1standard

Node

citrixsd-wan_400Match-

AND

citrixsd-wan_400_firmwareRange<11.4.1standard

Node

citrixsd-wan_410Match-

AND

citrixsd-wan_410_firmwareRange<11.4.1standard

Node

citrixsd-wan_1000Match-

AND

citrixsd-wan_1000_firmwareRange<11.4.1premium

citrixsd-wan_1000_firmwareRange<11.4.1standard

Node

citrixsd-wan_2000Match-

AND

citrixsd-wan_2000_firmwareRange<11.4.1premium

citrixsd-wan_2000_firmwareRange<11.4.1standard

Node

citrixsd-wan_2100Match-

AND

citrixsd-wan_2100_firmwareRange<11.4.1premium

citrixsd-wan_2100_firmwareRange<11.4.1standard

Node

citrixsd-wan_4000Match-

AND

citrixsd-wan_4000_firmwareRange<11.4.1standard

Node

citrixsd-wan_4100_firmwareRange<11.4.1standard

AND

citrixsd-wan_4100Match-

Node

citrixsd-wan_5100_firmwareRange<11.4.1premium

citrixsd-wan_5100_firmwareRange<11.4.1standard

AND

citrixsd-wan_5100Match-

Node

citrixsd-wan_6100_firmwareRange<11.4.1premium

citrixsd-wan_6100_firmwareRange<11.4.1standard

AND

citrixsd-wan_6100Match-

Node

citrixsd-wan_1100_firmwareRange<11.4.1premium

citrixsd-wan_1100_firmwareRange<11.4.1standard

AND

citrixsd-wan_1100Match-

Node

citrixsd-wan_center_management_consoleRange<11.4.3

citrixsd-wan_orchestratorRange<13.2.1on-premises

VendorProductVersionCPE
citrixsd-wan_110-cpe:2.3:h:citrix:sd-wan_110:-:*:*:*:*:*:*:*
citrixsd-wan_110_firmware*cpe:2.3:o:citrix:sd-wan_110_firmware:*:*:*:*:standard:*:*:*
citrixsd-wan_210-cpe:2.3:h:citrix:sd-wan_210:-:*:*:*:*:*:*:*
citrixsd-wan_210_firmware*cpe:2.3:o:citrix:sd-wan_210_firmware:*:*:*:*:standard:*:*:*
citrixsd-wan_400-cpe:2.3:h:citrix:sd-wan_400:-:*:*:*:*:*:*:*
citrixsd-wan_400_firmware*cpe:2.3:o:citrix:sd-wan_400_firmware:*:*:*:*:standard:*:*:*
citrixsd-wan_410-cpe:2.3:h:citrix:sd-wan_410:-:*:*:*:*:*:*:*
citrixsd-wan_410_firmware*cpe:2.3:o:citrix:sd-wan_410_firmware:*:*:*:*:standard:*:*:*
citrixsd-wan_1000-cpe:2.3:h:citrix:sd-wan_1000:-:*:*:*:*:*:*:*
citrixsd-wan_1000_firmware*cpe:2.3:o:citrix:sd-wan_1000_firmware:*:*:*:*:premium:*:*:*

Vendor	Product	Version	CPE
citrix	sd-wan_110	-	cpe:2.3:h:citrix:sd-wan_110:-:::::::*
citrix	sd-wan_110_firmware	*	cpe:2.3:o:citrix:sd-wan_110_firmware:::::standard:::*
citrix	sd-wan_210	-	cpe:2.3:h:citrix:sd-wan_210:-:::::::*
citrix	sd-wan_210_firmware	*	cpe:2.3:o:citrix:sd-wan_210_firmware:::::standard:::*
citrix	sd-wan_400	-	cpe:2.3:h:citrix:sd-wan_400:-:::::::*
citrix	sd-wan_400_firmware	*	cpe:2.3:o:citrix:sd-wan_400_firmware:::::standard:::*
citrix	sd-wan_410	-	cpe:2.3:h:citrix:sd-wan_410:-:::::::*
citrix	sd-wan_410_firmware	*	cpe:2.3:o:citrix:sd-wan_410_firmware:::::standard:::*
citrix	sd-wan_1000	-	cpe:2.3:h:citrix:sd-wan_1000:-:::::::*
citrix	sd-wan_1000_firmware	*	cpe:2.3:o:citrix:sd-wan_1000_firmware:::::premium:::*

Rows per page:

1-10 of 321

CNA Affected

[
  {
    "product": "Citrix SD-WAN",
    "vendor": "Citirx",
    "versions": [
      {
        "lessThan": "Citrix SD-WAN Center Management Console versions 11.4.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "Citrix SD-WAN Standard/Premium Edition Appliance versions 11.4.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "Citrix SD-WAN Orchestrator for On-Premises versions 13.2.1"
      }
    ]
  }
]

References

support.citrix.com/article/CTX370550

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

Related for CVE-2022-27506